CVE-2024-40776

What it actually does

Use-after-free vulnerability in WebKit allows malicious web content to trigger memory corruption resulting in an unexpected process crash.

Why it matters to the business

Users on unpatched Apple devices may experience browser or app crashes while viewing web content, leading to disrupted workflows and potential loss of productivity until updates are applied.

How an attack unfolds

An attacker hosts specially crafted web content that triggers the use-after-free condition in WebKit during rendering; when a victim visits the page using an affected browser or app, the process crashes without further attacker control or data access.

How to fix it

Update affected products to the fixed versions: Safari 17.6, iOS 16.7.9, iPadOS 16.7.9, iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Apply updates through standard Apple software update mechanisms as soon as available.

How to confirm the fix worked

Verify installed versions of Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS match or exceed the listed fixed releases; retest with known trigger content if available in a lab environment.

Typical attack path

1. Identify or create malicious web content that triggers the use-after-free in WebKit
2. Host the content on a web server or embed in a site the target may visit
3. Deliver a lure via phishing, search result, or compromised site to direct the victim to the content
4. Victim loads the page in Safari or another WebKit-based browser on an affected Apple platform
5. WebKit processes the content and crashes the renderer or browser process

How to detect it

Review system and application crash logs for WebKit renderer or Safari process terminations coinciding with web browsing activity; correlate with network logs showing visits to untrusted domains around the time of crashes.

What your security team should do

• Prioritize deployment of the listed Apple updates across all managed devices
• Enable automatic updates where possible to reduce exposure window
• Monitor crash reports for WebKit-related renderer crashes as a potential indicator of attempted exploitation
• Educate users on avoiding suspicious links until patches are applied