Apple systems and Safari: privilege escalation via cookie management issue (CVE-2024-54467) #shorts

Summary

Today, we're discussing the critical security vulnerability identified as CVE-2024-54467, affecting multiple Apple platforms. This vulnerability, published on March 10, 2025, could allow a malicious website to exfiltrate data across different origins, posing a significant threat to user privacy and data security.

Product details

The affected products include a range of Apple operating systems and applications: macOS versions earlier than 15, tvOS versions earlier than 18, visionOS before version 2, iOS and iPadOS versions up to 17, watchOS up to version 10, and Safari versions before 18. Each of these will require updates to ensure that users remain protected against potential exploits.

Vulnerability type summary

CVE-2024-54467 is classified as a cookie management issue, which is a broader category under web security vulnerabilities. This involves the improper handling of cookies, which are often used to store user information, and can lead to a malicious website gaining unauthorized access to cross-origin data.

Details of the vulnerability

The vulnerability stems from suboptimal state management of cookies, allowing a malicious website to exploit this flaw and potentially exfiltrate data across different web origins. This problem affects a wide array of Apple operating systems and requires users to update their systems to the latest versions, such as watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, and tvOS 18, where the issue has been resolved.

Conclusion

In conclusion, CVE-2024-54467 highlights the continuous battle between evolving security threats and the need for robust software design. We urge all users of affected Apple products to update their systems promptly to mitigate potential risks. As always, staying informed and vigilant is key to maintaining cybersecurity.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://support.apple.com/en-us/121238
• https://support.apple.com/en-us/121248
• https://support.apple.com/en-us/121249
• https://support.apple.com/en-us/121250
• https://support.apple.com/en-us/121240
• https://support.apple.com/en-us/121241