CVE-2024-44206

CRITICAL

Safari < 17.6 - Web Content Restriction Bypass via URL Protocol Handling

Title source: llm
STIX 2.1

Description

An issue in the handling of URL protocols was addressed with improved logic. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. A user may be able to bypass some web content restrictions.

References (7)

Core 7
Core References
Release Notes, Vendor Advisory
https://support.apple.com/en-us/120909
Release Notes, Vendor Advisory
https://support.apple.com/en-us/120911
Release Notes, Vendor Advisory
https://support.apple.com/en-us/120913
Release Notes, Vendor Advisory
https://support.apple.com/en-us/120914
Release Notes, Vendor Advisory
https://support.apple.com/en-us/120915
Release Notes, Vendor Advisory
https://support.apple.com/en-us/120916

Scores

CVSS v3 9.3
EPSS 0.0054
EPSS Percentile 67.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (12)
Apple/iOS and iPadOS < 17.6
apple/ipados < 17.6
apple/iphone_os < 17.6
apple/macos < 14.6
Apple/macOS < 14.6
apple/safari < 17.6
Apple/Safari < 17.6
apple/tvos < 17.6
Apple/tvOS < 17.6
apple/visionos < 1.3
... and 2 more
Published Oct 24, 2024
Tracked Since Feb 18, 2026