CVE-2024-44309: medium-severity vulnerability in Apple Safari
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in how Safari handles cookies could allow attackers to inject malicious scripts into web pages you visit, potentially stealing your data or hijacking your session. This has been actively exploited on Intel-based Macs.
A cookie state management vulnerability in Safari enables cross-site scripting (XSS) attacks through maliciously crafted web content. The attack requires user interaction with a compromised or attacker-controlled website and impacts Safari on macOS, iOS, and iPadOS, with documented active exploitation on Intel-based systems.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.