CVE-2024-23263: Apple Safari XSS Vulnerability

CVE-2024-23263 Overview

CVE-2024-23263 is a logic flaw in Apple's WebKit browser engine that allows maliciously crafted web content to bypass Content Security Policy (CSP) enforcement. The issue affects Safari and multiple Apple operating systems, along with the open-source WebKitGTK and WPE WebKit ports used by Linux distributions such as Fedora. Apple resolved the flaw with improved input validation in Safari 17.4, iOS 16.7.6 and 17.4, iPadOS 16.7.6 and 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. The weakness is classified under CWE-20: Improper Input Validation.

Critical Impact
Attackers who lure a user to a crafted page can neutralize CSP protections, enabling downstream script injection, data exfiltration, or clickjacking attacks that CSP was intended to block.

Affected Products

Apple Safari prior to 17.4 on macOS
Apple iOS/iPadOS (16.7.6, 17.4), macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4
WebKitGTK, WPE WebKit, and Fedora 38/39/40 packages using WebKit

Discovery Timeline

2024-03-08 - CVE-2024-23263 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23263

Vulnerability Analysis

The vulnerability resides in WebKit's handling of specific web content that intersects with Content Security Policy evaluation. A logic issue in the validation path allowed crafted markup or navigation sequences to slip past the policy engine, causing CSP directives to not be enforced as declared by the origin. Apple's advisory describes the fix as "improved validation," indicating the parser or enforcement routine failed to consistently apply policy checks for certain input states.

Exploitation requires user interaction: the victim must visit or be redirected to attacker-controlled content in a vulnerable WebKit-based browser. Confidentiality is not directly impacted, but integrity is high because CSP is a foundational defense-in-depth control. When CSP is bypassed, other content injection primitives such as reflected or stored cross-site scripting become exploitable against sites that rely on CSP as their compensating control.

Root Cause

The root cause is improper input validation ([CWE-20]) within WebKit's CSP enforcement logic. Specific classes of web content were not fully validated before policy decisions were rendered, allowing policy checks to be bypassed for those inputs. Apple has not published low-level implementation details beyond noting the validation improvement in the shipped patches.

Attack Vector

The attack is network-based and requires the target to load hostile web content. A typical exploitation chain would combine this bypass with a secondary injection primitive on a legitimate site that ships a restrictive CSP header. The attacker leverages the WebKit flaw to defeat the CSP allowlist, enabling execution of inline scripts, unauthorized resource loads, or exfiltration of tokens that CSP would ordinarily prevent. No authentication or elevated privileges are required. See the Apple Safari 17.4 advisory for the vendor description of processing maliciously crafted web content.

No verified public proof-of-concept code is available for this issue, so exploitation specifics are described in prose rather than reproduced here.

Detection Methods for CVE-2024-23263

Indicators of Compromise

Browser telemetry showing WebKit versions predating Safari 17.4, iOS/iPadOS 17.4, or macOS Sonoma 14.4 on managed endpoints.
Web server logs showing outbound resource loads from origins that should be blocked by a deployed CSP default-src or script-src directive.
CSP violation reports that suddenly stop arriving for events that historically triggered them, indicating enforcement was bypassed.

Detection Strategies

Correlate User-Agent strings against known-vulnerable WebKit build identifiers to identify unpatched clients accessing corporate web properties.
Monitor report-uri and report-to CSP endpoints for anomalies, including gaps in expected reporting or unusual violation payloads.
Instrument web applications to log script execution context and flag inline scripts running on pages that declare a strict CSP.

Monitoring Recommendations

Ingest browser and endpoint version inventory into a centralized data lake to identify Apple devices running vulnerable OS builds.
Track patch compliance for WebKitGTK and WPE WebKit packages on Linux servers, particularly Fedora 38, 39, and 40 hosts.
Alert on high-volume traffic from managed macOS or iOS clients to newly registered domains, a common precursor to drive-by attacks.

How to Mitigate CVE-2024-23263

Immediate Actions Required

Update Apple devices to Safari 17.4, iOS/iPadOS 16.7.6 or 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, or watchOS 10.4 or later.
Patch WebKitGTK and WPE WebKit on Linux hosts using vendor packages, including the corresponding Fedora WebKitGTK advisory.
Audit web applications that rely solely on CSP as a mitigating control and reinforce them with server-side output encoding and input validation.

Patch Information

Apple addressed CVE-2024-23263 across its product line on March 7-8, 2024. Refer to the vendor advisories: Safari 17.4 (HT214081), iOS/iPadOS 17.4 (HT214082), iOS 16.7.6 (HT214088), macOS Sonoma 14.4 (HT214084), tvOS 17.4 (HT214086), visionOS 1.1 (HT214089), and watchOS 10.4 (HT214087).

Workarounds

Restrict browsing on unpatched devices via web proxy or DNS filtering to reduce exposure to untrusted origins.
Enforce enterprise browser policies that require the latest Safari build before permitting access to sensitive internal applications.
Implement Strict-Transport-Security, X-Content-Type-Options, and Referrer-Policy headers as additional layers so that a bypassed CSP is not the only defense against injection attacks.

bash

# Verify Safari and macOS versions on managed endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString

# Update WebKitGTK on Fedora hosts
sudo dnf upgrade --refresh webkit2gtk4.0 webkit2gtk4.1 webkitgtk6.0