CVE-2024-23280: Apple Safari XSS Vulnerability

CVE-2024-23280 Overview

CVE-2024-23280 is an injection vulnerability in Apple's WebKit browser engine that allows a maliciously crafted webpage to fingerprint the user. The flaw affects Safari and all major Apple operating systems, along with the open-source WebKitGTK and WPE WebKit projects used on Linux distributions such as Fedora. Apple resolved the issue with improved input validation across its March 2024 security updates. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
A remote attacker can serve a crafted webpage that abuses improper input validation in WebKit to fingerprint the browsing user, undermining privacy protections that Safari and WebKit-based browsers enforce.

Affected Products

Apple Safari (prior to 17.4), iOS/iPadOS (prior to 17.4), macOS Sonoma (prior to 14.4), tvOS (prior to 17.4), and watchOS (prior to 10.4)
WebKitGTK and WPE WebKit versions preceding the March 2024 upstream fix
Fedora 38, 39, and 40 packages shipping the vulnerable WebKitGTK build

Discovery Timeline

2024-03-08 - CVE-2024-23280 published to the National Vulnerability Database (NVD)
2024-03-20 through 2024-03-26 - Additional details posted to the Full Disclosure and oss-security mailing lists
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23280

Vulnerability Analysis

The vulnerability resides in WebKit, the browser engine that powers Safari and every third-party browser on iOS. According to Apple's advisory, the root cause is an injection issue that Apple addressed with improved validation. When a user visits a malicious webpage, the crafted content abuses this validation gap to derive attributes about the user or the browsing environment. Because WebKit is shared across Safari, WebKitGTK, and WPE WebKit, the same defect propagates to Linux distributions that repackage those libraries.

User interaction is required because the target must load the attacker-controlled page. No authentication is needed, and the attack executes over the network with low complexity. While confidentiality is not directly impacted by the engine flaw, fingerprinting enables cross-site tracking and can support subsequent targeting of the user with tailored phishing, exploit, or social engineering campaigns.

Root Cause

WebKit failed to fully neutralize special elements before passing them to a downstream component, matching the pattern described in CWE-74. Apple's remediation is characterized as "improved validation," indicating that the parser or sanitization layer did not sufficiently constrain input handled by the affected code path. The insufficient validation allowed a crafted document to elicit distinguishable behavior that a script could observe.

Attack Vector

Exploitation requires an attacker to host or inject a malicious webpage and lure a user of a vulnerable browser to visit it. Typical delivery mechanisms include phishing links, malvertising, watering-hole compromises, and injected content on otherwise legitimate sites. Once loaded, the crafted page probes the WebKit rendering pipeline and collects attributes that can uniquely identify the client. No verified public proof-of-concept has been published for this issue; refer to Apple's advisories such as HT214081 and HT214084 for the vendor description of the fix.

Detection Methods for CVE-2024-23280

Indicators of Compromise

No file-based indicators of compromise have been published for this vulnerability.
Client-side telemetry showing repeated visits to unfamiliar domains that serve heavy JavaScript profiling logic to WebKit-based user agents.
Outbound connections from patched fleets that still report vulnerable Safari, WebKitGTK, or WPE WebKit version strings in User-Agent headers.

Detection Strategies

Inventory managed Apple endpoints and Linux hosts for Safari, WebKitGTK, and WPE WebKit builds released prior to March 2024 to identify exposure.
Correlate web proxy logs with threat intelligence feeds to flag domains associated with browser fingerprinting or tracking infrastructure.
Monitor for anomalous JavaScript execution patterns and repeated calls to WebKit APIs commonly abused for fingerprinting from newly observed domains.

Monitoring Recommendations

Enable browser telemetry that reports engine and OS version to a central log store so vulnerable clients can be identified quickly.
Alert on Fedora hosts that continue to run WebKitGTK packages predating the fixes shipped in the AO4BNNL5X2LQBJ6WX7VT4SGMA6R7DUU5, BAIPBVDQV3GHMSNSZNEJCRZEPM7BEYGF, IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4, and PXORDRCSQAQU436W4S2Z3X5B5PDXL3LI advisories.
Track privacy-relevant events, such as unusual canvas, WebGL, or audio-context API usage, in web application firewall and secure web gateway logs.

How to Mitigate CVE-2024-23280

Immediate Actions Required

Upgrade Safari to 17.4 and update Apple devices to iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, and watchOS 10.4.
Update WebKitGTK and WPE WebKit on Linux hosts, and apply the corresponding Fedora 38, 39, and 40 package updates.
Prioritize patching for user populations that browse untrusted content, including executives, developers, and researchers.

Patch Information

Apple resolved CVE-2024-23280 in its March 2024 security releases. Refer to the vendor advisories for detailed component and version data: Apple Support HT214081, HT214084, HT214086, HT214088, and HT214089. Fedora maintainers shipped fixed WebKitGTK packages via the announcements linked in the oss-security disclosure thread.

Workarounds

Restrict browsing on unpatched systems to a trusted allow-list until updates can be deployed.
Enable content filtering at secure web gateways to block domains known for aggressive fingerprinting or tracking.
Deploy privacy-focused browser configurations that limit exposed APIs, such as disabling non-essential JavaScript on high-risk endpoints.

bash

# Verify Safari and macOS versions on managed macOS endpoints
sw_vers -productVersion
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Update WebKitGTK on Fedora hosts
sudo dnf upgrade --refresh webkit2gtk4.0 webkit2gtk4.1 webkitgtk6.0