CVE-2024-44308

Exploited in the wild. In CISA KEV since 2024‑11‑21. Fixed versions are out.

CVSS 3.18.8High EPSS percentile96th10% chance in 30 days CISA KEVListedsince 2024-11-21, due 2024-12-12
No public exploit known Fix5 products4 fixed builds listed below

Published 2024-11-19Updated 2025-11-04Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Apple SafariAffected: < 18.1.1Upgrade to: 18.1.1Stated by: CVE record
Apple iOS and iPadOSAffected: < 17.7.2Upgrade to: 17.7.2Affected: < 18.1.1Upgrade to: 18.1.1Stated by: CVE record
Apple macOSAffected: < 15.1.1Upgrade to: 15.1.1Stated by: CVE record
Apple visionOSAffected: < 2.1.1Upgrade to: 2.1.1Stated by: CVE record
Apple IpadosAffected: < 17.7.2Upgrade to: 17.7.2Stated by: NVD

Versions as the sources state them. 7 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check the installed Safari and operating-system version on every company iPhone, iPad, Mac, and Vision Pro device.
Update Safari to 18.1.1; update iOS and iPadOS to 17.7.2 or 18.1.1, macOS to 15.1.1, and visionOS to 2.1.1.
Until updates are complete, restrict unpatched company Apple devices from browsing untrusted websites or accessing sensitive business accounts.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Nov 21, 2024·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

In plain language

Written by AI from the record

This is a serious flaw in Apple web browsing software that attackers have already used, so businesses using Safari or Apple devices should update them now.

CVE-2024-44308 is a high-severity WebKit arbitrary-code-execution vulnerability triggered by processing maliciously crafted web content.

If you're affected

Device takeover
Business data exposure
Malware installation
Work disruption

What is it

A malicious website can exploit a weakness in the software Apple devices use to display web pages. It is like a visitor handing a receptionist a document that lets the visitor walk past the front desk and take control of the office.

Who is affected

This matters to you if your business uses Apple WebKit through Safari, iPhones, iPads, Macs, or Vision Pro devices. It may also matter for systems using WebKitGTK, but the supplied findings do not provide a fixed version for those systems. The issue is triggered when a device processes malicious web content.

How urgent is it

Attackers are already exploiting this vulnerability in the real world, which makes this a red-priority update. CISA added it to its catalog of known exploited vulnerabilities and set December 12, 2024 as the remediation due date; that deadline has passed.

What to do — in detail

Confirm exposure through device-management inventory, operating-system update reports, and Safari version checks. Remediate Apple devices to Safari 18.1.1, iOS/iPadOS 17.7.2 or 18.1.1, macOS Sequoia 15.1.1, or visionOS 2.1.1, as applicable; use the normal Apple software-update path and test business-critical applications after operating-system upgrades. The findings do not identify a fixed WebKitGTK version, so obtain the current vendor update for the specific Linux distribution or restrict browser use until one is available. If patching is delayed, limit unpatched devices' access to untrusted web content and sensitive business services. CISA's KEV remediation due date was 2024-12-12. Monitor update-compliance reports and investigate unexpected browser crashes or device-management alerts on unpatched devices.

Technical context

CVSS 3.1 score: 8.8 (High), with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness is not classified beyond NVD-CWE-noinfo; the reported effect is arbitrary code execution through maliciously crafted web content. CISA KEV lists the vulnerability as actively exploited, while no public exploit code is on record. EPSS was 10.2% and rising, but confirmed exploitation is the controlling risk signal. Apple reported possible active exploitation on Intel-based Mac systems.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Listed as exploited in the wild since 2024-11-21.

US federal agencies must remediate by 2024-12-12.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained.

Lifecycle

8 events over 664 days, from the signal feeds we watch.

2026-09-14EPSS band change0 → moderateepss band change
2026-06-25OpenVAS check added
2025-11-04Patch availablerecord updated
2024-11-21Added to CISA KEV
2024-11-19Publishedweakness classified

Affected products

Apple Inc.commercial · USaka apple, apple computer
- SafariDesktop AppOn-premConsumer Software / browser
- ipadosOSEmbeddedOperating Systems / mobile-os
- iOS and iPadOSOSEmbeddedOperating Systems / mobile-os
- macOSOSOn-premOperating Systems / unix-bsd
- visionOSOSOperating Systems / mobile-os
Сообщество свободного программного обеспеченияoss-projectaka fsf
- Debian GNU/LinuxOSOn-premOperating Systems / linux-distro
- WebKitGTKLibraryLibraryOSS Libraries / generic-library
- WPE WebKitLibraryLibraryOperating Systems
debianoss-project · GBaka debian gnu/linux
- debian linuxOSOn-premOperating Systems / linux-distro
Red Hat Inc.commercial · USaka red hat
- Red Hat Enterprise LinuxOSOn-premOperating Systems / linux-distro
ООО «РусБИТех-Астра»commercial · RUaka rusbitech-astra
- Astra Linux Special EditionOSOn-premOperating Systems / linux-distro
Canonical Ltd.commercial · GBaka canonical
- UbuntuOSOn-premOperating Systems / linux-distro

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

NVD-CWE-noinfoNo name in the record

Sources

References in the record

And 17 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Safari, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account