CVE-2024-23206

What it actually does

The vulnerability permits a malicious webpage to bypass intended access restrictions in WebKit, enabling the collection of device and browser attributes that can be used to uniquely identify and track users across sessions.

Why it matters to the business

Organizations face increased privacy compliance risks and potential loss of user trust as attackers can silently profile visitors without consent, complicating regulatory obligations and exposing users to targeted tracking.

How an attack unfolds

An attacker hosts a specially crafted webpage that triggers the access control flaw in the browser's rendering engine; when a user visits the page, the script extracts fingerprinting data that would normally be restricted, allowing the attacker to build a persistent profile of the victim.

How to fix it

Update affected Apple products to the fixed versions listed in the advisory: Safari 17.3, iOS 16.7.5 / iPadOS 16.7.5, iOS 17.3 / iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, and watchOS 10.3. Apply updates through the standard system update mechanisms as soon as possible.

How to confirm the fix worked

Verify that all managed devices report the minimum patched versions via MDM inventory or device management consoles, and confirm that browser user-agent strings or system information tools reflect the updated releases.

Typical attack path

1. Attacker prepares and hosts a malicious webpage exploiting the WebKit access restriction flaw
2. Victim is lured to the page via phishing, compromised site, or ad network
3. Browser renders the page and executes the fingerprinting script due to the access issue
4. Script collects device attributes and transmits them to the attacker-controlled server
5. Attacker correlates the data to track the user across multiple sites or sessions

How to detect it

Review web proxy or browser telemetry logs for repeated visits to suspicious domains followed by unusual attribute collection patterns; correlate with threat intelligence on known fingerprinting campaigns associated with the listed threat actors.

What your security team should do

• Prioritize deployment of the listed security updates across all Apple endpoints within the next patching cycle
• Enable automatic updates for Safari and iOS/macOS devices where policy permits
• Review web filtering and browser policies to limit exposure to untrusted sites until patches are applied
• Monitor vendor release notes for any follow-on advisories related to WebKit components