VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jul 29, 2024· Updated Apr 2, 2026

CVE-2024-40785

CVE-2024-40785

Description

This issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to a cross site scripting attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Processing maliciously crafted web content in Apple Safari may lead to a cross-site scripting (XSS) attack.

Vulnerability

Description

CVE-2024-40785 is a cross-site scripting (XSS) vulnerability in Apple's WebKit engine, which underpins Safari and other web content rendering across Apple platforms. The bug was present in the processing of maliciously crafted web content, and Apple has addressed it with improved checks [1][2][4].

Attack

Vector and Prerequisites

An attacker can exploit this vulnerability by serving a specially crafted web page to a user. The attack requires no authentication or special network position; simply visiting the malicious web page in a vulnerable version of Safari or an application using WebKit is sufficient to trigger the flaw [1][2][4].

Impact

Successful exploitation could allow the attacker to execute arbitrary JavaScript in the context of the user's session, potentially leading to theft of cookies, session tokens, or other sensitive data, as well as performing actions on behalf of the user on other websites. Apple assesses the impact as potentially leading to a cross-site scripting attack [1][2][4].

Mitigation and

Patches

Apple has released security updates for affected platforms: Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6 [1][2][4]. Users should update their devices to the latest software versions to mitigate the risk. No workarounds have been publicly disclosed by Apple.

References
  1. About the security content of macOS Sonoma 14.6 - Apple Support
  2. About the security content of macOS Sonoma 14.6 - Apple Support
  3. About the security content of iOS 17.6 and iPadOS 17.6 - Apple Support

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

45

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

27

News mentions

0

No linked articles in our index yet.