CVE-2024-40785

What it actually does

Insufficient input sanitization checks when processing web content allow attacker-controlled scripts to execute within the victim's browsing context, bypassing same-origin protections.

Why it matters to the business

Users on widely deployed Apple devices may suffer unauthorized access to session data or actions performed on their behalf, increasing risk of account takeover or information disclosure across consumer and enterprise environments.

How an attack unfolds

An attacker crafts malicious web content containing an XSS payload designed to evade the flawed validation logic; when a victim on an affected Apple platform visits the page, the payload executes in the browser context, enabling theft of cookies, DOM manipulation, or phishing.

How to fix it

Upgrade affected devices to Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, or watchOS 10.6.

How to confirm the fix worked

Confirm device and application versions meet or exceed the listed fixed releases; attempt to render test web content containing known XSS vectors and verify execution is blocked.

Typical attack path

1. Identify or compromise a site that can deliver crafted web content to targets
2. Embed an XSS payload that evades the incomplete sanitization checks
3. Lure victims to the malicious page via phishing or watering-hole tactics
4. Payload executes upon rendering, performing actions in the user's session

How to detect it

Inspect browser console logs, network request histories, and proxy logs for unexpected script injections or cross-origin requests originating from rendered web content; correlate with endpoint telemetry for anomalous JavaScript execution on Apple platforms.

What your security team should do

• Apply the listed OS and browser updates organization-wide as the primary control
• Enforce automatic update policies for all Apple endpoints
• Review web proxy or endpoint logs for indicators of suspicious cross-origin script activity
• Educate users about risks of visiting untrusted sites until patches are deployed