Actively exploited in the wild

Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

Apple - Multiple Products · Listed in the CISA KEV since 2024-11-21. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2024-44309

MediumCVSS 6.3KEV

Published: 20/11/2024(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Risk Assessment

An attacker could execute an XSS attack, potentially leading to session data theft or unauthorized actions in the user's browser.

Recommendation

Update Safari, iOS, iPadOS, macOS, and visionOS to the latest versions to fix the vulnerability.

Other vulnerabilities in Safari, iOS, iPadOS, macOS, visionOS

CVE-2026-28962High
This issue was addressed with improved access restrictions. The vulnerability may lead to the disclosure of sensitive user information due to processing maliciously crafted web content.

Original NVD description (English source)

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.