CVE-2024-23254

MEDIUM

Safari < 17.4 - Cross-Origin Audio Data Exfiltration

Title source: llm
STIX 2.1

Description

The issue was addressed with improved UI handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. A malicious website may exfiltrate audio data cross-origin.

References (23)

Core 23
Core References

Scores

CVSS v3 6.5
EPSS 0.0043
EPSS Percentile 62.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (16)
Apple/iOS and iPadOS < 17.4
apple/ipad_os < 17.4
apple/iphone_os < 17.4
apple/macos < 14.4
Apple/macOS < 14.4
apple/safari < 17.4
Apple/Safari < 17.4
apple/tvos < 17.4
Apple/tvOS < 17.4
apple/visionos < 1.1
... and 6 more
Published Mar 08, 2024
Tracked Since Feb 18, 2026