CVE-2024-27838

What it actually does

The flaw permits a maliciously crafted webpage to bypass intended protections and collect unique identifying information about the user through insufficient logic in WebKit handling.

Why it matters to the business

Organizations risk privacy violations, unauthorized user tracking, and potential regulatory exposure from silent fingerprinting of visitors across web properties.

How an attack unfolds

An attacker creates a webpage exploiting the WebKit information disclosure issue to silently gather device and browser fingerprint data when a user visits the page; the data is then exfiltrated for tracking or targeted follow-on attacks.

How to fix it

Upgrade affected products to the fixed versions including Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5.

How to confirm the fix worked

Confirm deployment of the listed fixed versions and verify that test pages no longer leak fingerprinting data; review release notes for the addressed logic change.

Typical attack path

1. Attacker hosts malicious webpage leveraging the fingerprinting flaw
2. Victim is lured to the page via phishing or compromised sites
3. Webpage executes and extracts identifying attributes
4. Fingerprint data is collected and sent to attacker-controlled infrastructure

How to detect it

Examine web server logs and browser telemetry for visits to unexpected domains combined with unusual device attribute collection patterns; no widespread exploitation indicators are currently reported.

What your security team should do

• Prioritize patching all listed Apple products immediately due to public disclosure
• Monitor browser update compliance across the fleet
• Educate users on avoiding untrusted web links
• Review web application logging for anomalous fingerprinting attempts