CVE-2024-54502

What it actually does

Processing maliciously crafted web content triggers a memory corruption condition that causes an unexpected process crash in the affected Apple browser or system component.

Why it matters to the business

Web browsing on unpatched Apple devices can be disrupted, leading to loss of productivity and potential user frustration; high ecosystem prevalence across Safari, iOS, macOS and related platforms increases the scope of operational impact.

How an attack unfolds

An attacker hosts or delivers malicious web content that, when rendered by the vulnerable browser engine, triggers the memory corruption flaw and crashes the process; named threat actors have been associated with similar Apple product targeting in 2024 campaigns.

How to fix it

Update to Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, or watchOS 11.2 (or later) on all affected devices.

How to confirm the fix worked

Confirm devices are running the listed fixed versions or newer; re-test with known trigger web content to verify no crash occurs.

Typical attack path

1. Attacker crafts or hosts malicious web content designed to trigger the memory issue
2. Victim is lured to visit the malicious page via phishing, compromised site, or drive-by
3. Browser processes the content and hits the flawed code path
4. Process crashes, resulting in denial of service

How to detect it

Review browser crash logs and system reports on Apple devices for unexpected terminations when processing web content; correlate with threat actor campaigns targeting Apple products.

What your security team should do

• Prioritize patching Apple devices to the versions listed in remediation guidance due to rising EPSS trend
• Monitor for any future KEV addition given observed threat actor interest in Apple products
• Block or warn on untrusted web content sources until patches are deployed