CVE-2024-27820: Apple Safari RCE Vulnerability

CVE-2024-27820 Overview

CVE-2024-27820 is a memory handling vulnerability in Apple's WebKit browser engine that affects Safari and multiple Apple operating systems. Processing maliciously crafted web content can lead to arbitrary code execution within the browser process. The flaw is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and was addressed through improved memory handling in Apple's May 2024 security updates. Exploitation requires user interaction, such as visiting a malicious or compromised website. The vulnerability impacts Safari, iOS, iPadOS, macOS Sonoma, tvOS, visionOS, and watchOS.

Critical Impact

Remote attackers can achieve arbitrary code execution on affected Apple devices by enticing users to load malicious web content through Safari or any WebKit-based browser component.

Affected Products

• Apple Safari (versions prior to 17.5)
• Apple iOS and iPadOS (prior to 16.7.8 and 17.5)
• Apple macOS Sonoma (prior to 14.5), tvOS (prior to 17.5), visionOS (prior to 1.2), and watchOS (prior to 10.5)

Discovery Timeline

• 2024-06-10 - CVE-2024-27820 published to the National Vulnerability Database
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2024-27820

Vulnerability Analysis

The vulnerability resides in WebKit, the browser engine that powers Safari and all web content rendering on Apple platforms. According to Apple's advisory, the issue was addressed with improved memory handling, indicating a memory corruption weakness consistent with [CWE-119]. Processing web content from an attacker-controlled origin may lead to arbitrary code execution within the WebKit content process.

Because WebKit is shared across system components on Apple operating systems, this flaw extends beyond Safari. Any application that renders untrusted HTML, CSS, or JavaScript through WebKit inherits the same exposure. The Exploit Prediction Scoring System (EPSS) places this vulnerability in the 79th percentile, indicating elevated likelihood of exploitation activity compared to the general CVE population.

Root Cause

Apple has not released technical specifics, but the description ("addressed with improved memory handling") and CWE mapping point to a memory-safety defect in WebKit's handling of attacker-controlled web content. Such defects typically include out-of-bounds reads or writes, use-after-free conditions, or type confusion in JavaScriptCore or DOM-related components.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts crafted HTML or JavaScript on a website, in an advertisement, or within an embedded WebKit context. When a user visits the page, WebKit parses the content and triggers the memory corruption condition. Successful exploitation runs attacker-controlled code in the WebKit process context, which is the typical entry point for sandbox-escape chains targeting iOS and macOS.

No public proof-of-concept code or exploit is currently available, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical details are limited to Apple's security advisories. See the Apple Support Document for Safari 17.5 and the Full Disclosure Mailing List post for the disclosed scope.

Detection Methods for CVE-2024-27820

Indicators of Compromise

• Safari or WebKit-based application crashes (com.apple.WebKit.WebContent process terminations) coinciding with visits to untrusted sites
• Unexpected child processes spawned by Safari or other WebKit clients on macOS
• Outbound network connections from browser processes to previously unseen domains immediately following web content rendering

Detection Strategies

• Inventory Apple endpoints and verify Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions against the patched releases listed by Apple
• Correlate WebKit content process crash reports with browsing telemetry to identify suspected exploitation attempts
• Monitor managed Apple devices through MDM compliance reporting to flag systems still running vulnerable WebKit builds

Monitoring Recommendations

• Enable browser and EDR telemetry on macOS to capture process lineage from Safari and WebKit helper processes
• Alert on Safari spawning shells, scripting interpreters, or persistence-related binaries such as launchctl or osascript
• Track DNS and HTTP traffic from Apple endpoints for connections to known malicious or newly registered domains hosting exploit kits

How to Mitigate CVE-2024-27820

Immediate Actions Required

• Update Safari to version 17.5 and upgrade Apple operating systems to iOS/iPadOS 16.7.8 or 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5
• Push the updates through Mobile Device Management (MDM) to enforce compliance on managed fleets
• Restrict browsing to trusted sites on unpatched devices until updates are deployed

Patch Information

Apple released fixes across its product line in May 2024. Patches are documented in the Apple Support Document HT214100, HT214101, HT214102, HT214103, HT214104, HT214106, and HT214108. Each update applies the improved memory handling fix to the corresponding WebKit build.

Workarounds

• Disable JavaScript in Safari for high-risk users browsing untrusted sites until patches are installed
• Route browsing through a hardened web gateway or remote browser isolation solution to limit exposure to malicious web content
• Enforce least-privilege configurations and restrict installation of third-party WebKit-based applications on unpatched endpoints

# Verify Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Trigger Apple software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart