Exploited Apple WebKit flaw CVE-2024-27834 lets attackers bypass Pointer Authentication
Apple shipped the fixes in May 2024, so the risk sits with devices that missed updates since. NVD's references include a Sekoia report on watering-hole attacks against mobile devices using n-day exploits.
Affects
Safari
What to do
Update every Apple device and Safari install to a fixed release, starting with older iPhones and iPads.
- KEV listed
- CVE
- CVE-2024-27834
- CVSS
- 5.5 (v3.1, NVD)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Safari before 17.5 on macOS Monterey and macOS Ventura
- iOS and iPadOS before 16.7.8 on iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch and iPad Pro 12.9-inch 1st generation
- iOS and iPadOS 17 before 17.5
- macOS Sonoma before 14.5
- tvOS before 17.5
- watchOS before 10.5
- Fixed in
- Safari 17.5
- iOS 16.7.8 and iPadOS 16.7.8
- iOS 17.5 and iPadOS 17.5
- macOS Sonoma 14.5
- tvOS 17.5
- watchOS 10.5
How the flaw works
The flaw sits in WebKit and lets an attacker who already has arbitrary read and write access to memory bypass Pointer Authentication. An attacker must first gain that access through a separate bug. The same Apple releases fix a WebKit integer overflow that can lead to code execution from crafted web content.
What to do now
Take the inventory before any update, because each device line takes the fix in a different update: Safari for Monterey and Ventura Macs, and a separate iOS release for the iPhone 8, iPhone X and iPad 5th generation.
- Export OS and Safari versions for every Apple device from the device management console
- Update iPhones and iPads first, including the older models on the separate iOS release
- Update Safari on Macs still running Monterey or Ventura
- Update Sonoma Macs, Apple TV units and Apple Watches
- Block company mail and files on any device still short of a fixed release
Who is affected
Macs on Monterey or Ventura are exposed through Safari and take the fix as a Safari update. Macs on Sonoma take it in a macOS update, while Apple TV and Apple Watch units take their own system updates. CISA gave US federal agencies until 18 November 2026 to act.
Detection notes
CISA lists the flaw as exploited in attacks. Treat any work device left on an unfixed release as possibly compromised, and check it before it goes back into use.
- Devices in the management console reporting an iOS or iPadOS release older than the fixed builds
- Macs on Monterey or Ventura whose Safari version is older than the fixed release
- Personal phones outside management that still sync company mail
- Apple TV units in meeting rooms that never appear in the management console
Essential Eight mapping
Patch applications and patch operating systems both apply, as do user application hardening controls on the browser.
The Essential Eight Maturity Model sets 48 hours for internet-facing services, servers and network devices where a working exploit exists. Hold phones, Macs and browsers to the same window for this flaw, since attackers are already using it.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.11.04)Retrieved 6 Nov 2026
- PrimaryNIST NVD, CVE-2024-27834Retrieved 6 Nov 2026
- PrimaryApple, About the security content of Safari 17.5 (updated 15 January 2025)Retrieved 6 Nov 2026
- PrimaryApple, About the security content of iOS 16.7.8 and iPadOS 16.7.8 (updated 15 January 2025)Retrieved 6 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
