CVE-2024-27851

What it actually does

Insufficient bounds checks in WebKit lead to memory corruption that permits arbitrary code execution when processing malicious web content.

Why it matters to the business

Compromised Apple devices could allow attackers to steal data, install malware, or take control of systems through malicious websites, disrupting operations and requiring emergency patching across the fleet.

How an attack unfolds

An attacker hosts malicious web content that triggers the bounds-check flaw in WebKit; when a victim visits the page the corruption is exploited to achieve code execution inside the browser process.

How to fix it

Update to Safari 17.5, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2 or watchOS 10.5 (or later) on all affected devices.

How to confirm the fix worked

Confirm installed versions of Safari, iOS, iPadOS, macOS, tvOS, visionOS and watchOS meet or exceed the listed fixed releases and re-test web content handling.

Typical attack path

1. Host malicious web content on an attacker-controlled site
2. Lure victim to visit the site using an affected WebKit-based browser
3. Trigger memory corruption via crafted content
4. Escalate to arbitrary code execution

How to detect it

Examine browser and system logs for WebKit crashes or memory errors coinciding with visits to suspicious sites; inspect for unexpected code execution or injected processes in browser contexts.

What your security team should do

• Apply the listed updates immediately to all managed Apple devices
• Block or monitor access to untrusted web content until patches are deployed
• Review endpoint detection coverage for WebKit process anomalies