Daily · Article 01 · 4 min read
- Security
CISA lists exploitation of an Apple WebKit flaw: check the existing fixes
May 2024 fixes · November 4, 2026 CISA listing · originals checked November 5 JST
Summary
CISA added an Apple WebKit flaw to its exploitation catalog on November 4. The read/write prerequisite, historical 2024 fixes and current device records explain what an operator can check.
Apple-device operators have a new reason to compare current OS and Safari update records. On November 4, U.S. cybersecurity agency CISA added WebKit flaw CVE-2024-27834 to its exploited-vulnerability catalog. The fixes were published in 2024; the new development is confirmation of exploitation.
Key facts
CISA's KEV catalog lists iOS, iPadOS, macOS, Safari, tvOS and watchOS in this entry. The catalog was released at 05:00:05.774 JST on November 5, not the start time of an individual attack. Its description requires an attacker who already has arbitrary read and write capability. CISA catalog
Apple describes a WebKit pointer-authentication bypass and records the fix in releases dated May 13, 2024. Today's development is the exploitation listing, rather than a newly released first patch. Safari 17.5 security record
1. A fix date and an exploitation-listing date
A patch release means the developer distributed corrected software. KEV inclusion means CISA obtained evidence of exploitation and added the flaw to its action catalog. Even after time has passed, a device that missed the old fix can still require attention.
| Time or evidence | What it establishes | What it does not establish |
|---|---|---|
| Apple releases, May 13, 2024 | A fix was supplied for that product line | Installation on your device |
| CISA addition, November 4, 2026 | CISA confirmed exploitation of the flaw | Your device's infection or an attack start time |
| Current version and installation record | Evidence to assess that device's application state | Absence of every other security issue |
- Time or evidence
Apple releases, May 13, 2024
- What it establishes
- A fix was supplied for that product line
- What it does not establish
- Installation on your device
- Time or evidence
CISA addition, November 4, 2026
- What it establishes
- CISA confirmed exploitation of the flaw
- What it does not establish
- Your device's infection or an attack start time
- Time or evidence
Current version and installation record
- What it establishes
- Evidence to assess that device's application state
- What it does not establish
- Absence of every other security issue
The cat asks Q&A
The researcherIs a device updated long ago worth checking again?
Pocket NotebookMatch its current model, OS and browser versions with the fix and subsequent support path. A version read now and its installation record are more concrete than remembering an earlier update. An inventory lets an operator find devices missed across a fleet.
2. Protecting addresses used by a program
WebKit processes web content. Programs store data and addresses for later work in memory; a value referring to an address is a pointer. Pointer authentication checks a signature on certain addresses before use, making attacks based on altered addresses harder. Apple's pointer-authentication explanation
Apple says an attacker with arbitrary read/write capability may bypass that protection through this flaw. An existing ability to read or modify memory and the later bypass are separate parts of the situation. The advisory alone does not demonstrate an unconditional path from one webpage to complete device control.
%% Advisory conditions and weakened protection · explanatory flow, not an exploit replay
flowchart TD
A["Prerequisite: attacker already has<br/>Arbitrary read and write capability"] --> B["Before an address is used<br/>Pointer authentication checks its signature"]
B --> C["Vulnerable WebKit<br/>This flaw may bypass authentication"]
C --> D["Address-tampering protection weakened<br/>Full attack path needs separate evidence"]The cat asks Q&A
- The researcher
Where would I learn how the first intrusion happened?
Pocket NotebookLook for incident-investigation evidence or a further advisory addressing that step. The Apple and CISA records inspected here explain the read/write prerequisite and bypass, not a particular user's initial intrusion. They do not justify inventing password theft or infection through a named app.
3. From product-line records to a device's current state
The table lists historical May 13, 2024 releases explicitly naming this CVE. It is not a list of target versions to install today. Apple recommends current software, so compare it with the latest supported update offered for the model. A Mac may also need the separate Safari record applicable to its OS line. Current Apple security releases
Downloading an installer or scheduling an update does not prove completion. For example, a company-device owner can request its model, current OS and Safari versions and completion record from the administrator. A personal-device owner can compare the current state with Apple's update guidance. This publication did not inspect readers' devices.
| Historical security release | Scope to read in the document | Original |
|---|---|---|
| iOS and iPadOS 17.5 | The supported model list | Apple record |
| iOS and iPadOS 16.7.8 | Separate line for older devices | Apple record |
| macOS Sonoma 14.5 | Sonoma's WebKit entry | Apple record |
| Safari 17.5 | Monterey and Ventura | Apple record |
| tvOS 17.5 | Listed Apple TV models | Apple record |
| watchOS 10.5 | Listed Apple Watch models | Apple record |
- Historical security release
iOS and iPadOS 17.5
- Scope to read in the document
- The supported model list
- Original
- Apple record
- Historical security release
iOS and iPadOS 16.7.8
- Scope to read in the document
- Separate line for older devices
- Original
- Apple record
- Historical security release
macOS Sonoma 14.5
- Scope to read in the document
- Sonoma's WebKit entry
- Original
- Apple record
- Historical security release
Safari 17.5
- Scope to read in the document
- Monterey and Ventura
- Original
- Apple record
- Historical security release
tvOS 17.5
- Scope to read in the document
- Listed Apple TV models
- Original
- Apple record
- Historical security release
watchOS 10.5
- Scope to read in the document
- Listed Apple Watch models
- Original
- Apple record
The cat asks Q&A
- The researcher
What else should I check if no new update is offered?
Pocket NotebookFirst check whether the installed version already includes the fix and whether the model remains supported. For a company device, ask whether a management policy is delaying deployment. An empty update list alone establishes neither application nor lack of exposure; connect it with model and installation records.
To close
A response recorded per device
Connecting a vendor fix with each device's current state identifies remaining update targets. The exploitation listing raises the priority of that comparison; evidence of an individual compromise remains a separate question.
Sources
- CISA catalogcisa.gov
- Apple recordsupport.apple.com
- Apple's pointer-authentication explanationsupport.apple.com
- Current Apple security releasessupport.apple.com
- Apple recordsupport.apple.com
- Apple recordsupport.apple.com
- Apple recordsupport.apple.com
- Apple recordsupport.apple.com
- Apple recordsupport.apple.com