CVE-2024-54479

What it actually does

Malformed web content triggers insufficient validation checks that cause the WebKit process to terminate unexpectedly.

Why it matters to the business

Users experience abrupt browser or app crashes when viewing attacker-controlled pages, interrupting workflows and potentially reducing availability of web-dependent services across managed devices.

How an attack unfolds

An attacker hosts or links to specially crafted HTML or media content; when a victim device renders it in Safari or other affected Apple browsers, the flawed parsing path leads to an immediate crash. Threat actors listed in 2024 zero-day and espionage campaigns have been observed delivering similar web-borne payloads to achieve denial-of-service or as a precursor to further exploitation.

How to fix it

Apply the vendor-supplied updates: Safari 18.2, iOS 18.2 / iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Enforce automatic update policies and verify versions via MDM or device inventory.

How to confirm the fix worked

Confirm installed versions match or exceed the listed fixed releases; re-test with known triggering content samples in a lab environment and monitor for absence of the previously observed crash signature.

Typical attack path

1. Host or deliver malicious web content via compromised site, ad network, or direct link
2. Victim device loads the content in Safari, WebKit-based app, or embedded browser view
3. Parsing logic encounters the crafted input and triggers the crash condition
4. Target process terminates, denying service until restart

How to detect it

Search system and application crash logs for WebKit or Safari processes terminating while processing web content; correlate with web proxy or browser history entries pointing to suspicious domains around the time of the crash.

• WebKitProcess crash report containing unexpected termination after HTML/media parsing
• Safari/WebKit process name appearing in sudden termination logs without prior user action
• Browser history entries immediately preceding WebKit crash events

What your security team should do

• Prioritize deployment of the December 2024 Apple updates across all managed endpoints
• Enable automatic updates for Safari and operating systems where policy permits
• Review device inventory for any devices still running pre-18.2 Safari or equivalent older releases
• Add WebKit crash telemetry to existing monitoring dashboards for post-patch validation