CVE-2024-23206: Apple Safari Information Disclosure Vulnerability

CVE-2024-23206 Overview

CVE-2024-23206 is an access control weakness affecting Apple Safari and multiple Apple operating systems. A maliciously crafted webpage can leverage the flaw to fingerprint the user, enabling covert tracking without consent. Apple addressed the issue with improved access restrictions in Safari 17.3, iOS 16.7.5, iPadOS 16.7.5, iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, and watchOS 10.3. The vulnerability maps to [CWE-200] Information Exposure and requires user interaction, typically loading an attacker-controlled webpage. No active exploitation has been reported, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A crafted webpage can silently fingerprint Apple users, undermining browser privacy protections across iOS, iPadOS, macOS, tvOS, watchOS, and Safari.

Affected Products

Apple Safari (fixed in 17.3)
Apple iOS and iPadOS (fixed in 16.7.5 and 17.3)
Apple macOS Sonoma (fixed in 14.3), tvOS 17.3, and watchOS 10.3

Discovery Timeline

2024-01-23 - CVE-2024-23206 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23206

Vulnerability Analysis

The flaw is an information exposure issue [CWE-200] in Apple's WebKit-based browser stack. Insufficient access restrictions allowed a maliciously crafted webpage to query state or resources that should have been isolated from untrusted web content. The exposed data forms a persistent, high-entropy fingerprint that identifies a user across browsing sessions and sites.

Browser fingerprinting attacks combine device, rendering, and configuration signals to build a unique identifier. When the browser fails to gate one of those signals, tracking becomes possible even against users who block cookies or use private browsing. Apple resolved the issue by tightening access checks in the affected components rather than by changing the underlying API surface.

Root Cause

The root cause is missing or incomplete access restrictions on a resource reachable from web content. The affected code path did not sufficiently isolate the requesting origin from data that could distinguish one device or user profile from another. Apple's advisory documents the remediation as "an access issue was addressed with improved access restrictions," indicating a permission-boundary fix.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must visit or be redirected to an attacker-controlled or compromised site that serves the crafted content. Once the page loads, the site can passively collect fingerprintable attributes and correlate the visitor across unrelated web properties. No credentials, elevated privileges, or additional payloads are required.

See the Apple Safari 17.3 advisory and the iOS 17.3 advisory for vendor-provided technical context. The vulnerability is described in prose because no verified proof-of-concept code is publicly linked in the NVD record.

Detection Methods for CVE-2024-23206

Indicators of Compromise

Web traffic to newly registered or low-reputation domains serving JavaScript that queries unusual browser APIs or resource states.
Apple endpoints running Safari versions earlier than 17.3, or OS builds earlier than iOS/iPadOS 16.7.5, iOS/iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, or watchOS 10.3.
Repeated cross-site requests from the same client carrying identifiers consistent with fingerprint-based tracking rather than session cookies.

Detection Strategies

Inventory Apple devices and flag any Safari or OS build below the fixed versions listed in the Apple security releases index.
Correlate web-proxy logs with threat intelligence to surface visits to domains associated with tracking or malvertising infrastructure.
Review WebKit crash and telemetry data for anomalous access patterns to isolated browser resources.

Monitoring Recommendations

Enable centralized logging of browser version and OS build across managed Apple fleets via MDM.
Monitor egress traffic for third-party scripts loaded by uncommon top-level domains and evaluate them against fingerprinting heuristics.
Alert on managed devices that fall behind on Apple security updates beyond a defined patch SLA.

How to Mitigate CVE-2024-23206

Immediate Actions Required

Update Safari to 17.3 on macOS Ventura and Monterey installations.
Upgrade iOS and iPadOS devices to 16.7.5 or 17.3 depending on hardware eligibility.
Upgrade macOS Sonoma to 14.3, tvOS to 17.3, and watchOS to 10.3 across all managed Apple endpoints.
Push updates through MDM enforcement to prevent users from deferring the patch indefinitely.

Patch Information

Apple released fixes on January 22, 2024. Refer to the vendor bulletins for build numbers and installation guidance: Safari 17.3, iOS 17.3 and iPadOS 17.3, iOS 16.7.5 and iPadOS 16.7.5, macOS Sonoma 14.3, tvOS 17.3, and watchOS 10.3. Fedora also shipped updated WebKitGTK packages via the Fedora package announcement.

Workarounds

Restrict browsing on unpatched Apple devices to trusted sites and enforce web filtering at the network edge until updates are deployed.
Enable Safari's built-in tracking prevention features and consider installing content blockers that limit script execution from unfamiliar origins.
Use MDM configuration profiles to disable JavaScript on high-risk profiles when updates cannot be applied immediately.

bash

# Query installed Safari version on macOS to confirm patch status
mdls -name kMDItemVersion /Applications/Safari.app

# Check macOS build for Sonoma 14.3 or later
sw_vers -productVersion