CVE-2024-40780

What it actually does

Out-of-bounds read in WebKit during processing of malicious web content, addressed via improved bounds checking and resulting in process crash.

Why it matters to the business

Unexpected browser and app crashes on Apple devices when users encounter crafted web content, causing operational disruption and degraded user experience across iOS, macOS, and related platforms.

How an attack unfolds

An attacker crafts malicious web content that triggers an out-of-bounds read condition in WebKit; when a victim processes the content in an affected browser or app, the flaw causes an immediate process termination without further code execution.

How to fix it

Update affected products to the fixed versions: Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Apply updates immediately across all managed devices.

How to confirm the fix worked

Verify installed versions of Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS match or exceed the listed fixed releases; test with known-malicious web content samples in a controlled environment to confirm crash behavior is resolved.

Typical attack path

1. Attacker prepares and hosts maliciously crafted web content targeting WebKit.
2. Victim is directed to or visits the attacker-controlled content via Safari or another WebKit-based app.
3. WebKit processes the content and encounters the out-of-bounds read.
4. Affected process crashes, terminating the session or application.

How to detect it

Inspect system and application crash logs for WebKit or Safari processes terminating unexpectedly after web content access; correlate with browser history or network logs showing visits to untrusted domains.

What your security team should do

• Prioritize deployment of the listed Apple security updates to all endpoints and mobile devices.
• Enable automatic updates where possible and monitor for new WebKit-related advisories.
• Review crash logs from WebKit processes for patterns of unexpected terminations after web content exposure.