VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jun 10, 2024· Updated Apr 2, 2026

CVE-2024-27838

CVE-2024-27838

Description

The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A malicious webpage can fingerprint users due to a logic issue in WebKit, fixed in Safari 17.5 and other Apple OS updates.

Vulnerability

Overview

CVE-2024-27838 is a medium-severity (CVSS 6.5) privacy concern in Apple's WebKit rendering engine, which is used by Safari and many other apps. The root cause is a logic flaw in how the browser handles certain web content, allowing a maliciously crafted webpage to bypass protections and fingerprint the user's device or identity without consent. Apple addressed the issue by adding additional logic to prevent this fingerprinting [1].

Attack

Surface and Exploitation

The vulnerability is exploitable solely by convincing a user to visit a specially crafted webpage (no additional local access or privileges required). The attack is network-based and low complexity, as the webpage can be delivered via any standard web link. No authentication or user interaction beyond loading the page is needed, meaning a drive-by attack in a phishing email or a compromised advertisement could trigger the issue.

Impact

Successful exploitation allows an attacker to fingerprint the user, i.e., to collect unique or identifiable device and browser characteristics (such as screen resolution, installed fonts, or other browser-accessible details) that can be used to track the user across the web or link browsing sessions to a specific identity. This undermines user privacy protections that modern browsers typically implement.

Mitigation

Apple has fixed the issue in the following released versions: Safari 17.5, iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5 [1]. Users are strongly advised to update their devices to these latest versions. No workarounds are documented; the only mitigation is applying the vendor-supplied patch.

References
  1. About the security content of iOS 17.5 and iPadOS 17.5 - Apple Support

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.