CVE-2024-23213

What it actually does

Memory corruption flaw in WebKit allows processing of malicious web content to trigger arbitrary code execution in the context of the browser process.

Why it matters to the business

Enables remote compromise of Apple devices through web browsing, facilitating spyware deployment by groups such as Intellexa and increasing risk of data theft or persistent access on widely deployed consumer and enterprise endpoints.

How an attack unfolds

An attacker hosts malicious web content that triggers the memory handling issue during rendering in Safari or other WebKit-based browsers; successful exploitation grants arbitrary code execution, a technique observed in campaigns by Intellexa/Predator and other Apple WebKit memory corruption actors.

How to fix it

Apply the vendor updates that address the issue: Safari 17.3, iOS 16.7.5 / iPadOS 16.7.5, iOS 17.3 / iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, and watchOS 10.3. Disable JavaScript or use alternative browsers where immediate patching is not possible.

How to confirm the fix worked

Verify installed versions against the listed fixed releases on each affected platform; confirm WebKit process memory protections and sandbox integrity through standard Apple system update validation.

Typical attack path

1. Attacker prepares malicious webpage exploiting WebKit memory handling
2. Victim is directed to or visits the page using an affected Apple browser or app
3. Web content processing triggers out-of-bounds or type confusion memory corruption
4. Arbitrary code executes within the browser sandbox or escapes to achieve full compromise

How to detect it

Review browser process crash logs and WebKit memory violation reports for patterns matching known exploitation of this memory corruption class; correlate with network logs showing visits to suspicious domains previously associated with Intellexa or Predator campaigns.

What your security team should do

• Prioritize patching all affected Apple devices immediately given documented use by spyware actors
• Enable automatic updates and enforce rapid deployment for high-risk users
• Monitor threat intelligence for Intellexa/Predator activity targeting WebKit
• Limit web browsing from managed devices until patches are applied