CVE-2024-44187: Apple Safari Cross-Origin XSS Vulnerability

CVE-2024-44187 Overview

CVE-2024-44187 is a cross-origin vulnerability affecting Apple Safari and multiple Apple operating systems. The flaw stems from improper tracking of security origins in iframe elements, allowing a malicious website to exfiltrate data across origins. Apple addressed the issue in Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. The vulnerability maps to CWE-346: Origin Validation Error and requires user interaction, such as visiting an attacker-controlled webpage.

Critical Impact
A malicious website can bypass Same-Origin Policy protections via crafted iframe elements to read data from another origin, exposing session tokens, personal data, or authenticated content.

Affected Products

Apple Safari (versions prior to Safari 18)
Apple iOS and iPadOS (versions prior to 18)
Apple macOS Sequoia (versions prior to 15), tvOS (prior to 18), visionOS (prior to 2), watchOS (prior to 11)

Discovery Timeline

2024-09-17 - CVE-2024-44187 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44187

Vulnerability Analysis

The vulnerability resides in how WebKit tracks security origins associated with iframe elements. Under normal browser behavior, the Same-Origin Policy prevents scripts loaded from one origin from reading content served by another origin. When origin tracking becomes inconsistent during frame navigation or document transitions, an attacker-controlled parent document can access data that should remain isolated in a child frame.

Apple's advisory describes the fix as improved tracking of security origins, indicating the root cause was inaccurate origin state during frame lifecycle events. Exploitation requires only that a user visit or interact with a malicious page, which then embeds a target site inside an iframe and abuses the origin confusion to exfiltrate response data.

Root Cause

The root cause is an origin validation error [CWE-346] in WebKit's handling of iframe navigation. Security origin metadata was not consistently maintained across state changes, allowing cross-origin reads that should have been blocked by browser isolation controls.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted page containing an iframe referencing a victim origin where the user is authenticated. Once the user visits the page, JavaScript in the outer document abuses the origin tracking flaw to read cross-origin content, including authenticated responses, HTML, or embedded tokens. No privileges are required beyond a standard user session.

Because exploitation occurs entirely in the browser, standard network defenses such as firewalls or TLS inspection cannot detect the abuse. See the Apple security advisory for Safari 18 and related Full Disclosure post for additional context.

Detection Methods for CVE-2024-44187

Indicators of Compromise

Web browser telemetry showing unexpected outbound requests to attacker domains immediately after loading a third-party page containing iframe tags targeting sensitive internal or SaaS origins.
Content Security Policy (CSP) violation reports flagging unauthorized framing of authenticated applications by unknown origins.
Endpoint activity where Safari or WebKit-based apps on unpatched Apple devices connect to newly registered or low-reputation domains hosting embedded iframes.

Detection Strategies

Inventory Apple endpoints and identify systems still running Safari versions prior to 18 or operating systems predating the September 2024 updates.
Correlate browser process telemetry with DNS and proxy logs to surface sessions where an unpatched WebKit build interacts with untrusted domains referencing authenticated origins.
Ingest CSP report-uri and report-to feeds into a centralized analytics platform to detect anomalous framing attempts against corporate web assets.

Monitoring Recommendations

Monitor patch compliance dashboards for Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11 rollout coverage.
Track user reports of unexpected redirects, session invalidations, or credential prompts that could indicate cross-origin data theft.
Alert on newly observed domains embedding internal applications inside iframe elements via web proxy or secure web gateway logs.

How to Mitigate CVE-2024-44187

Immediate Actions Required

Deploy Apple's September 2024 security updates across all managed Apple devices, including Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11.
Prioritize endpoints used by executives, developers, and privileged administrators who authenticate to sensitive web applications from Safari or WebKit-based apps.
Enforce strict Content-Security-Policy and X-Frame-Options headers on internal and customer-facing applications to prevent unauthorized framing.

Patch Information

Apple published fixes in six advisories covering the affected platforms. Administrators should reference Apple Support Advisory 121238, 121240, 121241, 121248, 121249, and 121250 for version-specific guidance. A downstream WebKitGTK fix is available via the Debian LTS announcement.

Workarounds

Restrict browsing on unpatched Apple devices to trusted domains through enterprise web filtering until updates are applied.
Apply frame-ancestors 'self' in CSP headers on sensitive web applications to prevent embedding by attacker-controlled origins.
Require Mobile Device Management (MDM) enforcement of minimum OS versions before allowing access to corporate SaaS resources.

bash

# Configuration example: enforce frame-ancestors CSP header (nginx)
add_header Content-Security-Policy "frame-ancestors 'self';" always;
add_header X-Frame-Options "SAMEORIGIN" always;