CVE-2024-44246: Apple Safari IP Address Disclosure Vulnerability

CVE-2024-44246 Overview

CVE-2024-44246 is an information disclosure vulnerability affecting Apple Safari and related operating systems. On devices with iCloud Private Relay enabled, adding a website to the Safari Reading List can reveal the user's originating IP address to the target website. The flaw undermines the anonymity guarantee that Private Relay provides to Safari-originated traffic. Apple addressed the issue with improved routing of Safari-originated requests in Safari 18.2, iOS 18.2, iPadOS 18.2, iPadOS 17.7.3, and macOS Sequoia 15.2.

Critical Impact
Websites added to Safari Reading List can capture the user's real public IP address, bypassing iCloud Private Relay privacy protections and enabling user tracking or geolocation.

Affected Products

Apple Safari (versions prior to 18.2)
Apple iOS and iPadOS (versions prior to 18.2, and iPadOS prior to 17.7.3)
Apple macOS Sequoia (versions prior to 15.2)

Discovery Timeline

2024-12-12 - CVE-2024-44246 published to the National Vulnerability Database
2024-12-11 - Apple releases security updates documented in Apple Support Document #121837, #121838, #121839, and #121846
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44246

Vulnerability Analysis

The vulnerability stems from an inconsistency in how Safari routes network requests originating from the Reading List feature. iCloud Private Relay is designed to proxy Safari traffic through two separate relays so that neither Apple nor the destination website can associate the request with the user's real IP address. However, the request path used when adding a URL to the Reading List did not route through Private Relay. This exposed the client's originating IP address directly to the target web server. The issue falls under information disclosure and is tracked with [CWE-125] and NVD-CWE-noinfo categorization.

Root Cause

The root cause is a routing gap in Safari's networking stack. Reading List additions triggered a fetch or preview request that bypassed the Private Relay proxy chain. Apple's advisory describes the fix as "improved routing of Safari-originated requests," indicating the affected code path did not consistently apply the Private Relay routing policy that governs standard browsing traffic.

Attack Vector

Exploitation requires no authentication and no user interaction beyond the victim adding an attacker-controlled URL to their Safari Reading List. A website operator monitoring inbound HTTP requests can log the client IP address when the Reading List fetch occurs. Attackers can lure users into saving pages through phishing, social engineering, or seemingly benign content. The attack yields the user's public IP address, which can be used for geolocation, tracking, or correlation with other identifiers.

No public exploit code is available. Refer to the Apple security advisories for authoritative technical context.

Detection Methods for CVE-2024-44246

Indicators of Compromise

Web server access logs showing requests from residential or mobile IP ranges belonging to users who should appear as iCloud Private Relay egress addresses.
Discrepancies between the IP address seen for the initial page view and the IP address seen for subsequent Reading List fetch requests from the same client.
User-agent strings identifying Safari on iOS, iPadOS, or macOS combined with non-Private-Relay source IPs.

Detection Strategies

Audit endpoints and mobile devices to identify Apple systems running Safari, iOS, iPadOS, or macOS versions that predate the patched releases.
Review outbound network telemetry for Safari-originated traffic that fails to traverse expected Private Relay egress ranges.
Correlate browser version data from mobile device management (MDM) inventories against Apple's fixed version list.

Monitoring Recommendations

Enforce MDM policies that report Safari and OS build versions across the fleet, flagging devices below the fixed versions.
Monitor privacy-sensitive user workflows for use of unpatched Apple browsers and prompt updates.
Track Apple security advisory publications and align patch verification with the vendor documents linked in this article.

How to Mitigate CVE-2024-44246

Immediate Actions Required

Update Safari to version 18.2 or later on macOS systems that support it.
Upgrade iOS and iPadOS devices to version 18.2, or apply iPadOS 17.7.3 on devices ineligible for the 18.x release.
Upgrade macOS to Sequoia 15.2 to receive the bundled Safari fix.
Prioritize patching for users who rely on iCloud Private Relay for privacy-sensitive activity.

Patch Information

Apple published fixes across four advisories: Apple Support Document #121837, #121838, #121839, and #121846. The fix corrects the routing logic so that Reading List requests inherit the same Private Relay path as standard Safari browsing traffic.

Workarounds

Avoid using the Safari Reading List feature on unpatched devices when Private Relay privacy is required.
Use an alternative privacy tool such as a trusted VPN to mask the originating IP address until the patch is applied.
Restrict use of Private Relay-dependent workflows to devices confirmed to be on a fixed OS or Safari version.

bash

# Verify installed Safari version on macOS
mdls -name kMDItemVersion /Applications/Safari.app

# Confirm macOS build meets the fixed release
sw_vers -productVersion