CVE-2024-40857: Apple Safari XSS Vulnerability

CVE-2024-40857 Overview

CVE-2024-40857 is a universal cross-site scripting (UXSS) vulnerability affecting Apple Safari and multiple Apple operating systems. Processing maliciously crafted web content may lead to universal cross-site scripting, allowing attackers to execute script in the context of arbitrary origins. Apple addressed the flaw through improved state management in the affected browser and platform components. The issue is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A user visiting a malicious web page can trigger universal cross-site scripting, bypassing the same-origin policy and exposing session data across unrelated origins.

Affected Products

Apple Safari (versions prior to 18)
Apple iOS and iPadOS (versions prior to 18)
Apple macOS Sequoia (versions prior to 15), tvOS (prior to 18), visionOS (prior to 2), and watchOS (prior to 11)

Discovery Timeline

2024-09-17 - CVE-2024-40857 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40857

Vulnerability Analysis

The vulnerability enables universal cross-site scripting (UXSS) when Safari processes maliciously crafted web content. UXSS differs from traditional reflected or stored XSS because the flaw resides in the browser itself, not in a target web application. An attacker can inject script that executes in the security context of any origin the victim visits. This allows theft of session cookies, authentication tokens, and personal data from otherwise unrelated sites.

Apple's advisory attributes the fix to improved state management, indicating that internal browser state tracking failed to correctly enforce origin boundaries under specific conditions. The flaw requires user interaction, typically loading a hostile page or clicking a crafted link.

Root Cause

The root cause is inconsistent state management within Safari's web content processing pipeline. When frame navigation or document lifecycle transitions occurred in an unexpected order, origin isolation checks did not apply cleanly. This state confusion allowed script from one document context to affect another, breaking the same-origin policy.

Attack Vector

Exploitation requires a victim to load attacker-controlled web content in an unpatched Safari or WebKit-backed browser on an affected Apple operating system. No credentials or elevated privileges are needed. A successful attack yields script execution capable of reading data from, or acting on behalf of, any origin the victim interacts with in the affected browsing session.

No verified proof-of-concept code is publicly available for this issue. Technical details were referenced on the Full Disclosure Mailing List and Apple's advisories.

Detection Methods for CVE-2024-40857

Indicators of Compromise

Unexpected outbound HTTP requests from Safari to unfamiliar domains shortly after a user visits a new site
Session cookies or authentication tokens appearing in web server logs from mismatched Referer origins
Browser telemetry showing script execution or DOM modification against origins the user did not explicitly navigate to

Detection Strategies

Monitor endpoint inventory for Apple devices running Safari, iOS, iPadOS, macOS, tvOS, visionOS, or watchOS below the patched versions
Inspect web proxy and DNS logs for requests to known malicious or newly registered domains delivered through Safari user-agent strings
Correlate authentication anomalies, such as impossible-travel sign-ins, with recent Safari browsing sessions on unpatched devices

Monitoring Recommendations

Enable centralized logging of macOS unified logs and mobile device management (MDM) compliance reports to track Safari and OS version drift
Alert on Apple device fleet members that remain below Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, or watchOS 11
Review web application logs for suspicious cross-origin activity that could indicate UXSS-facilitated session abuse

How to Mitigate CVE-2024-40857

Immediate Actions Required

Update all Apple devices to Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, or watchOS 11 or later
Push updates through MDM enforcement policies to ensure fleet-wide compliance on managed endpoints
Instruct users to avoid clicking untrusted links and to close unfamiliar browser tabs until patches are applied

Patch Information

Apple released fixes across all affected platforms. Refer to Apple's advisories for the corresponding builds: Apple Support Document #121238, Apple Support Document #121240, Apple Support Document #121241, Apple Support Document #121248, Apple Support Document #121249, and Apple Support Document #121250.

Workarounds

Restrict use of Safari on unpatched devices and route users to an alternate, up-to-date browser where feasible
Deploy web content filtering to block access to known malicious or suspicious domains at the network perimeter
Enforce strict Content-Security-Policy and SameSite=Strict cookie attributes on internal web applications to reduce the impact of UXSS-based session theft

bash

# Verify installed Safari version on macOS
defaults read /Applications/Safari.app/Contents/Info.plist CFBundleShortVersionString

# Check macOS build version
sw_vers