CVE-2024-44187

MEDIUM

Safari < 18 - Origin Validation Error in iframe Element

Title source: llm
STIX 2.1

Description

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.

References (11)

Core 11

Scores

CVSS v3 6.5
EPSS 0.0065
EPSS Percentile 46.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-346
Status published
Products (13)
Apple/iOS and iPadOS < 18
apple/ipados < 18.0
apple/iphone_os < 18.0
Apple/macOS < 15
apple/macos < 15.0
Apple/Safari < 18
apple/safari < 18.0
Apple/tvOS < 18
apple/tvos < 18.0
Apple/visionOS < 2
... and 3 more
Published Sep 17, 2024
Tracked Since Feb 18, 2026