CVE-2024-23222highunder attackCWE-843

CVE-2024-23222: high-severity vulnerability in Apple Safari

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 11%
from disclosure to weapon777 days
Published on NVDJan 23
1st PoC+777d
CISA KEVJan 23
victimsOct 27
Appeared in 1 incident(s) we investigated
Sites e usuários de iPhone (campanha DeadTag)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
workaround: Do not process or load untrusted web content. Please update the affected package as soon as possible.
Fixed
13 products (377 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream E4S (v.8.6) · Red Hat Enterprise Linux AppStream E4S (v.9.0) · Red Hat Enterprise Linux AppStream EUS (v.9.2) · and others 8
fix ↗
Action required by CISAfederal deadline: 2024-02-13

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in how Safari processes certain web content allows attackers to confuse the browser about data types, potentially letting them run malicious code on your device. Updating your browser and operating system is essential to stay protected.

Technical detail

Type confusion vulnerability (CWE-843) in WebKit's type checking mechanisms allows an attacker to process maliciously crafted web content without proper type validation, leading to arbitrary code execution. The vulnerability requires user interaction (visiting a malicious website) and affects multiple Apple platforms; mitigation involves improved type checks in Safari 17.3 and corresponding OS updates.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, visionOS 1.0.2. Processing maliciously crafted web content may lead to arbitrary code execution. This fix associated with the Coruna exploit was shipped in iOS 17.3 on January 22, 2024. This update brings that fix to devices that cannot update to the latest iOS version.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOS and iPadOSApple · macOSApple · SafariApple · tvOSApple · visionOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple Safari

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEV