CVE-2024-27834: Patched Apple WebKit Flaw Added to CISA KEV as Part of an Exploit Chain
CISA put an Apple WebKit flaw patched in May 2024 on KEV. It scores 5.5, yet Sekoia ties it to an exploit chain that ends in cookie theft. Here is who is affected, the fixed versions, and what to do.
CISA added CVE-2024-27834, a pointer authentication bypass in Apple WebKit, to the Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026. Apple shipped the fix on May 13, 2024, and the CVSS score is a modest 5.5 Medium. The KEV entry sets a November 18, 2026 remediation deadline for federal agencies.
How the flaw works
Apple describes CVE-2024-27834 as a WebKit issue "addressed with improved checks." The impact line says an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Pointer Authentication is a protection on Apple processors that signs pointers, so a pointer overwritten by an attacker fails verification instead of redirecting code.
That wording matters. The bug is not a way in. It assumes the attacker can already read and write memory inside the browser engine, and it bypasses the pointer check that would otherwise stop the next step. Apple credits Manfred Paul, working with Trend Micro's Zero Day Initiative, and THN says the flaw was demonstrated at Pwn2Own Vancouver in March 2024. CISA's record classifies it as CWE-287 (Improper Authentication), while Red Hat uses CWE-305 (Bypass Protection Mechanism).
Who is affected
Apple fixed the flaw on May 13, 2024 on every platform that ships WebKit, and the Linux ports followed with WebKitGTK and WPE WebKit 2.44.2. Anything below these versions is affected. VulnTracker also lists Fedora 39 and 40.
Product | Fixed in | Applies to |
|---|---|---|
Safari | macOS Monterey and macOS Ventura | |
iOS and iPadOS 17 | iPhone XS and later, plus the iPad models listed in the advisory | |
iOS and iPadOS 16 | iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, iPad Pro 12.9-inch 1st generation | |
macOS Sonoma | macOS Sonoma | |
tvOS | Apple TV HD and Apple TV 4K | |
watchOS | Apple Watch Series 4 and later | |
WebKitGTK and WPE WebKit | Advisory WSA-2024-0003, May 21, 2024 | |
Ubuntu webkit2gtk | Ubuntu 24.04, 23.10 and 22.04; focal, bionic and xenial are marked Ignored | |
Red Hat webkitgtk4 | RHEL 7 Extended Life Cycle Support, issued July 7, 2025 |
Why a 5.5 still made KEV
The score rates one link, not the chain. CISA's CVSS 3.1 vector for the flaw is local, low privileges, no user interaction, with high integrity impact only, which gives 5.5 Medium. Red Hat scores the same CVE 8.8 with a network vector and user interaction. Neither number says how the bug is used, and VulnTracker shows EPSS at 0.6%.
Sekoia's report shows the use. It attributes the campaign to APT29 with moderate to high confidence. One of its iOS exploit chains, labeled Class A and aimed at iOS 16.7, pairs CVE-2025-43529, a WebContent remote code execution flaw, with CVE-2024-27834 as the pointer authentication bypass, and ends in a JavaScript cookie stealer. Victims reached the exploit through compromised legitimate sites, lookalike domains, and a supply chain compromise of the Plerdy SEO Tracker script between August 27 and September 3, 2026.
That is the pattern worth taking from this listing. A bug that needs read and write access first looks minor alone. It becomes useful the moment another bug supplies that access, and the score cannot see that. Apple's own advisories for it carry no exploitation note, so the evidence came 2.5 years later, from Sekoia and CISA.
Reading it on VulnTracker
The CVE page opens with an Actively Exploited banner: CISA KEV, EPSS 0.6%, added to KEV on November 4, 2026, remediation due November 18, 2026. Ransomware use is shown as Unknown. The SSVC panel reads Active, Not automatable, Partial impact, and the CVSS panel shows the 5.5 from CISA-ADP.
In the Affected section, the VulnTracker VTDB tab lists nine products with ranges merged and marked as our inference where Apple states only the fixed version. The MITRE CNA tab shows five entries and the NVD CPE tab ten, so the three sources can be compared side by side. Under Vendor advisories (19), Red Hat's RHSA-2025:10364 for webkitgtk4 carries a vendor: exploited tag. The Remediation section says no written guidance exists yet and shows only the fixed versions inferred from the ranges.
What to do
- Update every Apple device to the newest release available for its model. The fixed floor is iOS and iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5, but anything that can run a newer release should take it.
- Update WebKitGTK and WPE WebKit to 2.44.2 or later, and pull the distro build: the Ubuntu webkit2gtk 2.44.2 packages, the Fedora update, or RHSA-2025:10364 for webkitgtk4 on RHEL 7 ELS.
- Confirm that any device on the iOS 16 line is on 16.7.8. Sekoia's Class A chain targets iOS 16.7, and 16.7.8 is the fix Apple lists for iPhone 8, iPhone 8 Plus, iPhone X and several older iPads.
- If you run a website, check whether it loads the Plerdy SEO Tracker script. Sekoia dates the compromise of a.plerdy[.]com/public/js/click/main.js between August 27 and September 3, 2026.
- For a device that browsed untrusted sites while below the fixed version, treat its browser sessions as exposed and sign out or rotate tokens, since the Class A payload steals cookies. This is a precaution, not a confirmed compromise.
Federal agencies have until November 18, 2026 under the KEV listing.
Takeaway
A Medium score on a bug that needs read and write access first says little about how attackers use it. CVE-2024-27834 was fixed in May 2024 and reached KEV in November 2026 because it completes an exploit chain, and any Apple or WebKit system below the fixed versions is still missing that fix. Patch before the November 18 date, and track the Apple and WebKit products you run on VulnTracker so the next KEV listing for them reaches you the day it lands.
References
- Apple: Safari 17.5 security content
- Apple: iOS 16.7.8 and iPadOS 16.7.8 security content
- Apple: iOS 17.5 and iPadOS 17.5 security content
- Apple: macOS Sonoma 14.5 security content
- Apple: tvOS 17.5 security content
- Apple: watchOS 10.5 security content
- CVE Program record for CVE-2024-27834
- NVD entry for CVE-2024-27834
- CISA alert: CISA adds one known exploited vulnerability to catalog
- Sekoia: Poisoned Source, APT29 watering holes target mobile devices with n-day exploits
- The Hacker News: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
- WebKitGTK advisory WSA-2024-0003
- Ubuntu security: CVE-2024-27834
- Red Hat: CVE-2024-27834
- Red Hat: RHSA-2025:10364
Related reading
CVE-2026-119977: WordPress Core Upgrade-Window Flaw Added to CISA KEV After Attacks on the Staged Installer
A WordPress Core race condition that runs code during a core update is now on CISA KEV. Attackers are polling the staging path and waiting for sites to update. Here is who is affected, the fixed versions, and what to do.
Exploited CVEs Oct 26-Nov 1, 2026
Nine CVEs from eight vendors joined CISA KEV last week, from a 2.7 VMware logging flaw to a CVSS 10.0 GitLab bug. Same SSVC tags got three-day and 14-day deadlines, so here is what to patch first and why.
CVE-2026-111357: Ivanti Connect Secure Root Escalation Added to KEV as the Last Link in a Zero-Day Chain
A 7.0 rated Ivanti Connect Secure flaw is now on CISA KEV. It was the last step of a three-exploit chain that reached root on a fully patched appliance. Here are the fixed builds and why a clean integrity check is not enough.