CVE-2024-27808

What it actually does

Memory corruption flaw in WebKit that allows processing of malicious web content to achieve arbitrary code execution.

Why it matters to the business

Attackers could seize full control of macOS, iOS, iPadOS and related devices through malicious websites, enabling data theft or spyware deployment; known threat actors have targeted similar WebKit issues, increasing urgency despite no ransomware linkage.

How an attack unfolds

An attacker crafts malicious web content that triggers the WebKit memory handling flaw, hosts or injects it on a site visited by the victim, and achieves code execution on the device; Intellexa/Predator spyware campaigns have exploited comparable Apple WebKit memory corruption and type confusion issues.

How to fix it

Update to Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5 or later versions.

How to confirm the fix worked

Verify device and application versions match or exceed the listed fixed releases; retest web content rendering in updated environments.

Typical attack path

1. Craft malicious webpage exploiting WebKit memory corruption
2. Host or compromise site to deliver the payload
3. Lure victim to visit the site using vulnerable browser
4. Trigger arbitrary code execution on the device

How to detect it

Review browser process crashes or anomalous child processes following web visits; correlate with known Intellexa/Predator campaign indicators in endpoint logs.

What your security team should do

• Immediately apply the listed Apple updates across all managed devices
• Monitor threat intelligence for Intellexa/Predator activity targeting WebKit
• Block or sandbox untrusted web content until patches are deployed