CVE-2024-40794

What it actually does

The vulnerability stems from insufficient state management in the private browsing feature, allowing unauthorized access to tabs that should require authentication.

Why it matters to the business

Attackers could view private browsing activity, potentially exposing sensitive information like visited sites or form data without user consent; widespread use of affected Apple products increases organizational exposure risk.

How an attack unfolds

An attacker with network access can exploit the authentication bypass to retrieve content from private browsing sessions by abusing the flawed state handling.

How to fix it

Update Safari to version 17.6, iOS and iPadOS to 17.6, and macOS Sonoma to 14.6 or later.

How to confirm the fix worked

Verify the installed version matches or exceeds the fixed releases and test that private browsing requires proper authentication.

Typical attack path

1. Identify vulnerable Apple device running affected Safari or OS version
2. Leverage the state management flaw to bypass authentication checks
3. Access private browsing tabs remotely or locally without credentials

How to detect it

Review system logs for unexpected access to browser processes or private mode indicators; check for anomalies in Safari activity.

What your security team should do

• Apply the latest updates to affected Apple products immediately
• Monitor for any unusual access patterns to browser sessions
• Educate users on the importance of keeping software updated