Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

MEDIUM 6.3EXPLOITED (CISA KEV)CVE-2024-44309 · Published 20/11/2024 · updated 17/06/2026

Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 21/11/2024. Patch affected systems as an emergency.

In short

CVE-2024-44309 is a MEDIUM (CVSS 6.3) vulnerability affecting safari (apple).
Exploited in the wild: CISA added it to the KEV catalog on 21/11/2024.
Chance of exploitation in the next 30 days (EPSS): 21.9%, higher than 97.7% of all vulnerabilities.
Fix: update to 18.1.1 or later.

Package	Affected versions	Patched versions
safari apple	`< 18.1.1`	`18.1.1`

Description

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

References

support.apple.com/en-us/121752 · Vendor Advisory
support.apple.com/en-us/121753 · Vendor Advisory
support.apple.com/en-us/121754 · Vendor Advisory
support.apple.com/en-us/121755 · Vendor Advisory
support.apple.com/en-us/121756 · Vendor Advisory
seclists.org/fulldisclosure/2024/Nov/16 · Mailing List
lists.debian.org/debian-lts-announce/2024/12/msg00003.html · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2024-44309

More vulnerabilities in safari

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

safari

apple

< 18.1.1

18.1.1

Description

More vulnerabilities in safari

See all →