CVE-2024-23280

What it actually does

An injection flaw in WebKit's input handling allows a malicious webpage to bypass validation and extract device or browser characteristics for user fingerprinting.

Why it matters to the business

Organizations face increased privacy risks and potential regulatory exposure when users on unpatched Apple or WebKit-based systems visit attacker-controlled sites, enabling covert tracking that bypasses normal browser protections.

How an attack unfolds

An attacker hosts a crafted webpage that triggers the injection during rendering; the page then collects identifying signals from the browser or device that should have been blocked, allowing persistent fingerprinting without user consent. Threat actors such as Intellexa have targeted similar WebKit weaknesses in campaigns against Apple ecosystems.

How to fix it

Upgrade Safari to 17.4 or later, iOS/iPadOS to 17.4 or later, macOS Sonoma to 14.4 or later, tvOS to 17.4 or later, and watchOS to 10.4 or later. For Fedora, WebKitGTK, and WPE WebKit packages, apply the latest available updates that incorporate the validation fix.

How to confirm the fix worked

Verify installed versions against the fixed releases listed in remediation; confirm that updated WebKit components reject the previously injectable input patterns used for fingerprinting.

Typical attack path

1. Attacker prepares and hosts a malicious webpage exploiting the injection vector
2. Victim is lured to the page via phishing, compromised site, or ads
3. Page renders and triggers the validation bypass in WebKit
4. Browser leaks fingerprinting data back to attacker-controlled server
5. Attacker correlates the data to track the user across sessions or sites

How to detect it

Monitor browser process logs, network traffic from WebKit-based applications, and endpoint telemetry for anomalous script execution or data exfiltration patterns originating from rendered web content; correlate with known threat actor infrastructure associated with Apple WebKit exploitation campaigns.

What your security team should do

• Prioritize patching all affected Apple devices and WebKit-based applications within standard change windows given the stable but non-zero EPSS
• Enable automatic updates for Safari, iOS, macOS, and related WebKit ports where possible
• Review web proxy or endpoint logs for unexpected outbound connections from browsers to unknown domains that could indicate fingerprinting attempts
• Educate users on avoiding suspicious links until patches are deployed