CVE-2024-23254

What it actually does

The flaw permits a malicious website to bypass cross-origin restrictions and exfiltrate audio data by exploiting insufficient UI handling protections in WebKit.

Why it matters to the business

Organizations face increased risk of unauthorized exposure of sensitive audio information captured or processed in browsers, potentially leading to privacy compliance issues and loss of user trust.

How an attack unfolds

An attacker hosts a malicious website that leverages the UI handling weakness to initiate cross-origin audio data access and exfiltration without proper user consent or origin checks.

How to fix it

Update affected Apple products to the fixed versions: Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4.

How to confirm the fix worked

Verify installed browser and OS versions match or exceed the listed fixed releases and confirm the issue no longer reproduces with test cross-origin audio scenarios.

Typical attack path

1. User visits attacker-controlled website
2. Malicious page triggers audio-related UI interactions
3. Flaw allows cross-origin data access
4. Audio data is exfiltrated to attacker server

How to detect it

Review web proxy or browser logs for unexpected cross-origin audio requests or data transfers originating from untrusted domains.

What your security team should do

• Prioritize patching all managed Apple devices and browsers to the specified fixed versions
• Monitor for any post-patch reports of audio data handling anomalies
• Educate users on risks of visiting untrusted websites