CVE-2025-24201

Think of your web browser as a sealed room that's supposed to keep anything on a webpage from touching the rest of your device. This flaw lets a malicious website pick the lock on that room and get into the rest of the device — just by you visiting the page, with no clicks or downloads needed. Attackers have already used this trick against real targets.

This matters if your business uses Apple devices or software — iPhones, iPads, Macs, Apple Watches, Apple Vision Pro — or browsers built on the WebKit/WebKitGTK engine (including some Linux systems like Astra Linux and devices using Osnova Onyx). No login or special action is needed beyond visiting a malicious webpage, since the attack works over the network against anyone browsing with an unpatched version.

This is being actively exploited right now — CISA has confirmed real-world attacks and ordered US federal agencies to fix it by April 3, 2025. A working exploit is also public, making it easier for more attackers to use. Treat this as urgent: update affected devices immediately rather than waiting for a routine update cycle.

Confirm exposure by checking installed versions of Safari, iOS, iPadOS, macOS, watchOS, and visionOS across all organization-owned and BYOD Apple devices, plus any WebKitGTK/WPE WebKit-based Linux browsers. Target fixed versions: Safari 18.3.1; iOS 15.8.4, 16.7.11, or 18.3.2 depending on device support tier; iPadOS 15.8.4 or 17.7.6; macOS Sequoia 15.3.2; watchOS 11.4; visionOS 2.3.2. There is no clean workaround — Apple's advisory notes this is a supplementary fix for sandbox-escape behavior previously addressed in iOS 17.2, so devices on very old branches need the specific point release matching their OS line. CISA KEV sets a remediation due date of 2025-04-03 for federal systems; align internal SLAs to that or sooner given confirmed in-the-wild exploitation. Monitor for anomalous Safari/WebKit crashes, unexpected process spawning from browser processes, and apply MDM-enforced update policies to prevent drift on managed fleets.

CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network-reachable, no-auth, no-interaction exploitation with complete confidentiality/integrity/availability impact and scope change (sandbox escape). Weakness is CWE-787 (out-of-bounds write) in WebKit's Web Content process. Listed in CISA KEV since 2025-03-13 with confirmed real-world exploitation; a public PoC exists on GitHub, indicating mature exploit availability beyond the original sophisticated targeted attack. EPSS predicts moderate-to-low near-term mass-exploitation likelihood, but this is superseded by confirmed KEV status. Sustained press/research attention (actor: PARS Defense) corroborates ongoing scrutiny but should not be read as driving urgency beyond the KEV listing itself.