CVE-2024-23222

What it actually does

This is a WebKit type-confusion vulnerability that can be triggered when an affected Apple platform processes maliciously crafted web content. Type confusion occurs when code treats an object as the wrong internal type, which can corrupt memory and allow attacker-controlled code execution in the context of the browser or WebKit content process. Successful exploitation can compromise confidentiality, integrity, and availability of the affected device. The vulnerability is remotely reachable over the network but requires user interaction, such as visiting a malicious page, opening a malicious link, viewing attacker-controlled web content in an app, or rendering embedded browser content. Apple fixed the issue by adding improved type checks in Safari 17.3, iOS/iPadOS 15.8.7, iOS/iPadOS 16.7.5, iOS/iPadOS 17.3, macOS Monterey 12.7.3, macOS Ventura 13.6.4, macOS Sonoma 14.3, tvOS 17.3, and visionOS 1.0.2. The supplied downstream package data also identifies configmap-reload-fips from Chainguard as fixed in 0.12.0-r2.

Why it matters to the business

An attacker can compromise an affected Apple device if a user is induced to open malicious web content, which can lead to device takeover, data theft, surveillance, session compromise, or installation of follow-on malware. This vulnerability is listed in CISA KEV, has confirmed in-the-wild exploitation, and is associated with the Coruna exploit and Intellexa/Predator spyware activity, making it urgent for organizations with Apple endpoints, mobile devices, managed browsers, or embedded WebKit usage. CISA's KEV remediation due date was 2024-02-13, so any remaining exposure is significantly overdue. Although the EPSS score is moderate, confirmed exploitation and spyware association should drive prioritization above score-only ranking.

How an attack unfolds

An attacker prepares a webpage, message, advertisement, or embedded webview payload containing JavaScript and web content designed to trigger the WebKit type-confusion condition. The victim is then lured to process that content through Safari, another browser component using WebKit, an in-app browser, or a preview/rendering feature on an affected Apple operating system. When WebKit parses and executes the crafted content, memory is corrupted because an object is handled as an incompatible type. With a reliable exploit, the attacker gains arbitrary code execution in the WebKit content process. In targeted spyware operations, this initial code execution is commonly chained with additional sandbox escape, privilege escalation, or persistence techniques to access messages, files, credentials, microphone/camera data, location data, or other sensitive device information. Public reporting links exploitation to the Coruna exploit and Intellexa/Predator spyware activity, so investigations should treat suspicious Safari/WebKit crashes and targeted-link activity around the publication window as potentially high risk.

How to fix it

Upgrade affected Apple software to a fixed version or later: Safari 17.3 or later; iOS/iPadOS 15.8.7, 16.7.5, or 17.3 or later; macOS Monterey 12.7.3 or later; macOS Ventura 13.6.4 or later; macOS Sonoma 14.3 or later; tvOS 17.3 or later; and visionOS 1.0.2 or later. For the supplied downstream package, upgrade configmap-reload-fips from Chainguard to 0.12.0-r2 or later. Prioritize internet-facing, executive, journalist, legal, government, security, and other high-risk user devices because this vulnerability has been exploited in the wild and is associated with commercial spyware. If immediate patching is not possible, reduce exposure by disabling or restricting risky web content where operationally feasible, limiting use of unmanaged browsers or in-app browsers, enforcing mobile device management compliance, blocking known malicious domains when available from threat intelligence feeds, and encouraging users not to open unsolicited links. Mitigations should be treated as temporary; patching is the durable fix.

How to confirm the fix worked

Confirm Apple devices report fixed or later versions through MDM inventory, endpoint management, or local version checks. Validate Safari version is 17.3 or later where Safari is separately managed, and validate OS versions meet or exceed the relevant fixed releases for iOS, iPadOS, macOS, tvOS, and visionOS. For macOS, confirm build/software update status using system inventory or commands such as sw_vers and softwareupdate --history. For iOS/iPadOS, confirm Settings > General > About or MDM-reported OS version. For the supplied package, confirm configmap-reload-fips is 0.12.0-r2 or later using the relevant package/SBOM scanner. Re-run vulnerability scanning or SBOM assessment after updates. As a negative validation step, ensure no assets remain on iOS/iPadOS versions earlier than 15.8.7, 16.7.5, or 17.3; macOS Monterey earlier than 12.7.3; macOS Ventura earlier than 13.6.4; macOS Sonoma earlier than 14.3; Safari earlier than 17.3; tvOS earlier than 17.3; or visionOS earlier than 1.0.2.

Typical attack path

1. Identify users running affected Apple software versions or devices that cannot update to the latest major operating system.
2. Deliver a malicious link, compromised webpage, malicious advertisement, message, or webview-rendered payload to the target.
3. Cause the target device to process the crafted web content in Safari, WebKit, or an application component that embeds WebKit.
4. Trigger the WebKit type-confusion flaw during content parsing or script execution.
5. Achieve arbitrary code execution in the WebKit content process.
6. Optionally chain a sandbox escape or privilege-escalation vulnerability to gain broader device access.
7. Deploy spyware, steal browser/session data, access local files or messages, or perform surveillance actions.
8. Remove artifacts or rely on ephemeral browser/process crashes to reduce forensic visibility.

How to detect it

Detection is difficult because WebKit memory-corruption exploits often leave limited durable artifacts and may be used as part of targeted spyware chains. Review MDM, EDR, mobile threat defense, unified logs, browser history, DNS, proxy, secure web gateway, and crash analytics for evidence that affected devices processed suspicious web content followed by Safari/WebKit instability or unusual post-exploitation behavior. On macOS, inspect Unified Logs and DiagnosticReports for repeated or unexplained crashes involving Safari, WebKit, JavaScriptCore, or com.apple.WebKit.WebContent, especially EXC_BAD_ACCESS, KERN_INVALID_ADDRESS, type confusion, or memory-corruption style crashes. On iOS/iPadOS, review available sysdiagnose, analytics, MDM security telemetry, and mobile threat defense alerts for Safari/WebKit crashes, suspicious link launches, configuration/profile changes, abnormal network connections, or spyware-like behavior. Correlate timestamps of crashes with web proxy/DNS requests, inbound messages, email links, URL previews, and short-link redirects. Because public reporting associates exploitation with the Coruna exploit and Intellexa/Predator spyware, investigate targeted-link delivery, unknown domains contacted only by a small number of users, and any device behavior consistent with commercial spyware. Absence of these artifacts does not prove non-exploitation; patched state and targeted forensic review are the strongest assurance mechanisms.

• com.apple.WebKit.WebContent
• com.apple.WebKit.Networking
• com.apple.WebKit.GPU
• MobileSafari
• Safari
• WebKit
• JavaScriptCore
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• SIGSEGV
• DiagnosticReports/Safari
• DiagnosticReports/com.apple.WebKit.WebContent
• JetsamEvent
• Coruna
• Predator Spyware
• Intellexa

What your security team should do

• Immediately identify and remediate all affected Apple endpoints and mobile devices because this vulnerability is in CISA KEV and has confirmed in-the-wild exploitation.
• Prioritize high-risk users and devices that may be targeted by spyware operators, including executives, administrators, journalists, legal teams, government-related users, and security personnel.
• Enforce fixed minimum OS and Safari versions through MDM compliance policies, conditional access, or device posture controls.
• Hunt for Safari/WebKit crash artifacts, suspicious link-click events, unusual browser child-process behavior, and post-exploitation indicators around January 2024 onward, with emphasis on targeted users.
• Correlate web proxy, DNS, EDR, MDM, crash, and mobile threat defense telemetry for suspicious web content access followed by WebKit crashes or abnormal device behavior.
• Where devices cannot be upgraded, isolate them from sensitive workflows, restrict browsing and message-based link handling, and plan accelerated replacement.
• For software supply chain contexts, update configmap-reload-fips from Chainguard to 0.12.0-r2 or later and refresh SBOM/vulnerability attestations.
• Treat successful exploitation as a potential spyware compromise and follow mobile/endpoint incident response procedures, including evidence preservation before device wipe where feasible.