Actively exploited in the wild
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
Apple - Multiple Products · Listed in the CISA KEV since 2024-11-21. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-44309
MediumCVSS 6.3KEVSummary
A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Risk Assessment
An attacker could execute an XSS attack, potentially leading to session data theft or unauthorized actions in the user's browser.
Recommendation
Update Safari, iOS, iPadOS, macOS, and visionOS to the latest versions to fix the vulnerability.
Other vulnerabilities in Safari, iOS, iPadOS, macOS, visionOS
See all- CVE-2026-28962High
This issue was addressed with improved access restrictions. The vulnerability may lead to the disclosure of sensitive user information due to processing maliciously crafted web content.
- CVE-2025-43535Medium
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2025-43501Medium
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Original NVD description (English source)
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS