CVE-2025-24201

The flaw involves an out-of-bounds write in allocated memory buffer in the WebKit engine during processing of maliciously crafted web content. Insufficient control mechanisms allow an attacker to perform unauthorized memory operations, resulting in escape from the isolated Web Content process (sandbox escape). Apple indicates this is a supplementary security fix for an attack that was previously blocked in iOS 17.2 — this means the original attack vector was known earlier, but could be bypassed on older system versions.

An attacker can break out of the browser process isolation (sandbox escape), which could consequently lead to unauthorized access to the operating system, compromise of confidentiality, integrity, and availability of data on the victim's device.

Update immediately to the following versions: Safari 18.3.1, iOS 18.3.2 / iPadOS 18.3.2, iOS 16.7.11 / iPadOS 16.7.11, iOS 15.8.4 / iPadOS 15.8.4, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Updates are available through standard Apple update mechanisms.

Apple Safari (before 18.3.1), iOS and iPadOS (before 18.3.2, 16.7.11, 15.8.4), iPadOS 17.7.6, macOS Sequoia (before 15.3.2), visionOS (before 2.3.2), watchOS (before 11.4). Active exploitation confirmed on iOS versions earlier than iOS 17.2.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.