The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after reports that attackers are exploiting the flaw. The vulnerability has a medium severity rating, with a CVSS score of 5.5, and affects multiple Apple operating systems.
The flaw involves improper authentication. An attacker who already has arbitrary read and write capability could use it to bypass Pointer Authentication. Apple addressed the issue in May 2024 through updates to iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. It was demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
CISA’s catalog update follows a report from Sekoia describing attacks that used previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of collecting browser and device data. Sekoia attributed the activity, with moderate to high confidence, to APT29, also known as Cozy Bear and Midnight Blizzard, a group affiliated with Russia’s Foreign Intelligence Service.
The reported attacks use compromised legitimate websites, fake sites imitating popular destinations, or a supply-chain attack targeting Plerdy SEO Tracker to deliver malicious JavaScript. The script profiles a visitor’s device and triggers vulnerabilities before deploying an information-stealing payload. The reported zero-click exploit chain combines a WebKit remote-code-execution flaw, CVE-2025-43529, with a pointer authentication codes bypass to run JavaScript designed to steal browser cookies.
CISA recommends that Federal Civilian Executive Branch agencies apply the necessary patches by November 18, 2026.
Sources: The Hacker News.