CVE-2024-27850 Overview
CVE-2024-27850 is a privacy vulnerability affecting Apple Safari and multiple Apple operating systems. A maliciously crafted webpage can fingerprint the user by exploiting weaknesses in the noise injection algorithm designed to defeat browser fingerprinting. Apple addressed the issue by improving the noise injection algorithm across Safari 17.5, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, and visionOS 1.2. The weakness is categorized under [CWE-359] (Exposure of Private Personal Information to an Unauthorized Actor). Exploitation requires user interaction, specifically visiting an attacker-controlled webpage.
Critical Impact
A remote attacker hosting a malicious webpage can uniquely fingerprint a user's device, undermining browser anti-tracking defenses across Safari, iOS, iPadOS, macOS Sonoma, and visionOS.
Affected Products
- Apple Safari (versions prior to 17.5)
- Apple iOS and iPadOS (versions prior to 17.5)
- Apple macOS Sonoma (versions prior to 14.5) and Apple visionOS (versions prior to 1.2)
Discovery Timeline
- 2024-06-10 - CVE-2024-27850 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-27850
Vulnerability Analysis
The vulnerability resides in Safari's anti-fingerprinting logic. Modern browsers inject randomized noise into APIs commonly used for fingerprinting, such as canvas, WebGL, and AudioContext readouts. The intent is to break deterministic device signatures without visibly degrading site functionality. In vulnerable Safari builds, the noise injection algorithm produces output that a crafted webpage can normalize or invert, allowing recovery of a stable device identifier. Apple's advisories describe the fix as improvements to the noise injection algorithm. Refer to the Apple Support Article HT214101 and Apple Support Article HT214103 for the vendor description.
Root Cause
The root cause is insufficient entropy or predictable transformation in the noise applied to fingerprinting-relevant browser APIs. When noise is deterministic or narrowly distributed, an attacker aggregating repeated measurements can filter it out and derive a persistent identifier. This class of weakness is tracked as [CWE-359], reflecting exposure of information that should remain private to the user.
Attack Vector
Exploitation is network-based and requires user interaction. A victim must load an attacker-controlled or attacker-influenced webpage in a vulnerable Safari or WebKit-based context. The malicious page executes JavaScript that queries fingerprinting APIs multiple times, statistically strips the injected noise, and produces a stable identifier tied to the device. No authentication, prompts, or additional privileges are needed beyond page navigation. See the Full Disclosure June 5, 2024 posting for public discussion context.
Detection Methods for CVE-2024-27850
Indicators of Compromise
- Web traffic to unfamiliar domains hosting heavy client-side JavaScript that repeatedly reads from canvas, WebGL, or AudioContext APIs within short windows.
- Repeated POSTs from browser sessions containing serialized fingerprint payloads or hashed device signatures to third-party endpoints.
- Browser telemetry showing Safari or WebKit versions predating 17.5 / macOS Sonoma 14.5 / visionOS 1.2 in active use.
Detection Strategies
- Inventory Safari, iOS, iPadOS, macOS, and visionOS versions across managed endpoints and flag builds below the fixed versions.
- Inspect web proxy and DNS logs for scripts sourced from known fingerprinting-as-a-service providers loaded by Safari user agents.
- Correlate outbound requests from Safari processes with URL categorization data to surface tracking and profiling domains.
Monitoring Recommendations
- Enforce MDM policies that report installed OS and Safari versions to a central asset inventory on a recurring schedule.
- Alert when unmanaged or personal Apple devices below the patched versions connect to corporate resources.
- Monitor privacy-sensitive user cohorts (executives, researchers) for repeated visits to newly registered domains that request high-entropy browser APIs.
How to Mitigate CVE-2024-27850
Immediate Actions Required
- Update Safari to 17.5 or later, and iOS and iPadOS to 17.5 or later on all managed devices.
- Update macOS Sonoma to 14.5 or later and visionOS to 1.2 or later without delay.
- Verify patch compliance through MDM (Jamf, Intune, Kandji) and quarantine devices that remain on vulnerable builds.
Patch Information
Apple shipped the fix by improving the noise injection algorithm. Reference the vendor advisories for exact build numbers: Apple Support HT214101, Apple Support HT214103, Apple Support HT214106, and Apple Support HT214108. Additional details are available in Apple Support Article 120896 and Apple Support Article 120903.
Workarounds
- Use Safari's Private Browsing mode, which applies stricter anti-fingerprinting protections, for sensitive browsing on unpatched systems.
- Enable iCloud Private Relay for eligible users to reduce cross-site tracking signals originating from network metadata.
- Restrict browsing on unpatched devices to trusted internal sites via web filtering until updates are applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.