CVE-2024-23254 Overview
CVE-2024-23254 is a cross-origin information disclosure vulnerability in Apple's WebKit rendering engine. A malicious website can exfiltrate audio data across origin boundaries, bypassing the Same-Origin Policy that normally isolates content between web origins. Apple addressed the issue with improved user interface handling and shipped fixes in Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. Downstream WebKit consumers including WebKitGTK, WPE WebKit, and Fedora were also affected. The flaw requires user interaction, such as visiting an attacker-controlled page, and does not require authentication.
Critical Impact
A malicious website can capture and exfiltrate audio content from other origins, exposing sensitive media data and potentially leaking user conversations processed through WebKit-based browsers.
Affected Products
- Apple Safari prior to 17.4, iOS/iPadOS prior to 17.4, macOS Sonoma prior to 14.4
- Apple tvOS prior to 17.4, visionOS prior to 1.1, watchOS prior to 10.4
- WebKitGTK, WPE WebKit, and Fedora 40 packages shipping affected WebKit builds
Discovery Timeline
- 2024-03-08 - CVE-2024-23254 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23254
Vulnerability Analysis
The vulnerability resides in WebKit, the browser engine that powers Safari and multiple downstream browsers. According to Apple's advisory, the flaw allows a malicious website to exfiltrate audio data cross-origin, which represents a violation of the Same-Origin Policy (SOP). The Same-Origin Policy is a foundational web security control that prevents one origin from reading resources served by another origin.
Apple categorizes the fix as an improvement to user interface handling, suggesting the underlying issue involved how audio playback context or media element state was presented and mediated to script running on a different origin. Successful exploitation requires the victim to load attacker-controlled content, which is common in phishing and drive-by browsing scenarios. The Exploit Prediction Scoring System (EPSS) rates the exploitation probability at 1.253% at the 67th percentile.
Root Cause
The root cause is insufficient enforcement of origin boundaries around audio media resources within WebKit. The NVD lists the weakness as NVD-CWE-noinfo, and Apple has not published low-level technical details. The advisory language points to interface state that allowed cross-origin audio content to be observed by script that should not have had access to it.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a page that embeds or references audio content from another origin, then uses WebKit APIs to read or infer audio data that should be opaque under SOP. The result is confidentiality loss without any impact to integrity or availability of the underlying system. No verified proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code is publicly available. Refer to the Apple Support Article HT214081 and related advisories for authoritative technical guidance.
Detection Methods for CVE-2024-23254
Indicators of Compromise
- Safari, WebKitGTK, or WPE WebKit versions below the patched releases (Safari 17.4, iOS/iPadOS 17.4, macOS Sonoma 14.4)
- Browser telemetry showing unexpected <audio> or Web Audio API cross-origin fetches to attacker-controlled domains
- Outbound HTTP POST requests carrying base64-encoded audio blobs shortly after a user visits an untrusted site
Detection Strategies
- Inventory endpoints for Apple OS and Safari build numbers and flag versions prior to the March 2024 security updates
- Inspect web proxy and DNS logs for connections to newly registered domains hosting audio-heavy content followed by large outbound payloads
- Correlate browser process activity with unusual media element usage using endpoint telemetry
Monitoring Recommendations
- Enforce and monitor patch compliance across managed Apple fleets using MDM reporting
- Alert on Linux hosts running unpatched webkit2gtk or wpewebkit packages, including Fedora 40 systems
- Track browser exploitation indicators via endpoint detection and response (EDR) telemetry and web gateway inspection
How to Mitigate CVE-2024-23254
Immediate Actions Required
- Update Safari to 17.4 and Apple operating systems to iOS/iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4
- Apply distribution package updates for webkit2gtk and wpewebkit, including the Fedora 40 update referenced in the Fedora Package Announcement
- Restrict browsing to trusted sites on unpatched systems until updates are deployed
Patch Information
Apple documented the fix across multiple advisories, including Apple Support Article HT214081, Apple Support Article HT214084, Apple Support Article HT214086, Apple Support Article HT214087, Apple Support Article HT214088, and Apple Support Article HT214089. Downstream WebKit projects shipped corresponding updates.
Workarounds
- Disable JavaScript for untrusted sites using Safari content restrictions or an enterprise policy
- Use a browser not built on affected WebKit versions for high-risk browsing scenarios
- Deploy web filtering to block newly registered and low-reputation domains that could stage malicious audio content
# Verify Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app
# Update Fedora WebKit packages
sudo dnf upgrade --refresh webkit2gtk4.0 webkit2gtk4.1 wpewebkit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
