CVE-2024-23273: Apple Safari Auth Bypass Vulnerability

CVE-2024-23273 Overview

CVE-2024-23273 is a state management flaw affecting Apple Safari, iOS, iPadOS, and macOS Sonoma. The vulnerability allows Private Browsing tabs to be accessed without the required authentication prompt. Apple addressed the issue through improved state management in Safari 17.4, iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4. The flaw is classified under [CWE-295] and relates to improper validation of session or authentication state before exposing protected browser content.

Critical Impact
Users who rely on Private Browsing authentication to shield sensitive tabs may have those tabs revealed to anyone with physical or remote access to the device, exposing confidential browsing activity.

Affected Products

Apple Safari (prior to 17.4)
Apple iOS and iPadOS (prior to 17.4)
Apple macOS Sonoma (prior to 14.4)

Discovery Timeline

2024-03-08 - CVE-2024-23273 published to the National Vulnerability Database (NVD)
2024-03-08 - Apple releases security patches in Safari 17.4, iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23273

Vulnerability Analysis

The vulnerability resides in Safari's handling of Private Browsing session state. Safari offers an authentication gate that locks Private Browsing tabs behind biometric or passcode verification when the browser is reopened or returned to the foreground. Due to improper state management, this authentication check can be skipped under specific conditions, exposing tab contents without validating the user.

The issue is categorized under [CWE-295] in NVD metadata, reflecting weaknesses tied to validation controls. The scope is limited to confidentiality: an attacker viewing a locked device or interacting with the browser can read tabs that should remain protected. There is no integrity or availability impact, and no code execution path is involved.

Root Cause

The root cause is incomplete state tracking across Private Browsing lock and unlock transitions. Safari failed to consistently enforce the authentication requirement before rendering previously opened private tabs, allowing the UI to display protected content before the lock state was fully evaluated.

Attack Vector

Exploitation requires user interaction and local access to the browser session. An attacker with brief access to an unlocked device—or a user following a crafted navigation flow—can trigger the UI condition that bypasses the Private Browsing authentication prompt. No network-based exploitation primitive has been published, and no proof-of-concept code is listed in public exploit databases.

The vulnerability is described in prose only; no verified public exploit code is available. See the Apple Support Technical Document #HT214081 for vendor-provided details.

Detection Methods for CVE-2024-23273

Indicators of Compromise

No file-based or network indicators have been published for this vulnerability.
User reports of Private Browsing tabs appearing without the expected authentication prompt should be treated as suspicious on unpatched systems.

Detection Strategies

Inventory Apple endpoints and identify Safari, iOS, iPadOS, and macOS versions older than the patched releases (Safari 17.4, iOS/iPadOS 17.4, macOS Sonoma 14.4).
Use mobile device management (MDM) and endpoint telemetry to flag devices that have not applied the March 2024 Apple security updates.
Monitor Apple software update compliance in configuration management reporting.

Monitoring Recommendations

Track Apple software update deployment status across managed Macs, iPhones, and iPads.
Alert on devices that remain on vulnerable OS or Safari versions beyond the organization's patch SLA.
Review MDM compliance dashboards to confirm forced-update policies have taken effect.

How to Mitigate CVE-2024-23273

Immediate Actions Required

Update Safari to version 17.4 or later on macOS.
Update iPhones and iPads to iOS 17.4 or iPadOS 17.4 or later.
Upgrade macOS Sonoma systems to version 14.4 or later.
Enforce the updates through MDM policies for managed fleets.

Patch Information

Apple released fixes in Safari 17.4, iOS 17.4, iPadOS 17.4, and macOS Sonoma 14.4. Refer to the vendor advisories for release notes and verification steps: Apple Support Technical Document #HT214081, Apple Support Technical Document #HT214084, and Apple Support Technical Document #HT214089.

Workarounds

Avoid leaving devices unlocked and unattended, especially when Private Browsing is in use.
Close Private Browsing tabs manually before leaving a session on unpatched devices.
Enforce short device auto-lock timeouts through MDM configuration profiles until patches are deployed.

bash

# Verify Safari version on macOS
/usr/bin/mdls -name kMDItemVersion /Applications/Safari.app

# Verify macOS build version
sw_vers

# Trigger software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -ia --restart