CISA Put a 2024 Apple Safari Bug on Its Exploited List. It Is the Cookie-Stealing Half of the APT29 Watering-Hole Chain, and Federal Agencies Have Until November 18.
If you have an iPhone that is stuck on iOS 16, or any Apple device that missed the May 2024 updates, update it today, and treat browser cookies on it as at risk. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4 and gave federal civilian agencies until November 18. The bug is a pointer authentication bypass in Apple's WebKit and Safari stack, rated 5.5, which sounds minor and is not, because it is the second step in a chain.
What CISA listed
CVE-2024-27834 is an improper authentication flaw that lets an attacker who already has arbitrary read and write capability bypass pointer authentication, per The Hacker News's account of the listing. Apple fixed it in May 2024 with improved checks in iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. It was shown as a zero-day at the Pwn2Own Vancouver contest in March 2024. CISA's catalog entry in our copy is dated November 4, and the federal deadline is November 18, 2026.
We could not open CISA's alert page, which returned HTTP 403 to us. The date and deadline come from The Hacker News, and the date matches our own copy of the catalog.
Why a 5.5 matters here
Pointer authentication is a hardware-backed defense that makes it harder to turn a memory bug into code execution. A bypass is rarely the first step. It needs the attacker to already have read and write inside the process, which another bug supplies. So the score reads low in isolation and the bug is dangerous in a chain.
That is exactly where it shows up. Sekoia's report on the APT29 Poisoned Source campaign, which we covered on November 4, lists CVE-2024-27834 in chain A, the one aimed at iOS 16.7, alongside CVE-2025-43529. Our post's table says chain A steals Safari cookies. The Hacker News ties today's KEV listing to the same Sekoia report, and attributes the activity to APT29 with moderate to high confidence, per Sekoia. The entry in the listing does not mention APT29, and CISA's alert did not load for us, so the attribution is Sekoia's and not CISA's.
Who is exposed
This is an inference from our earlier post, not a vendor statement. Chain A targets iOS 16.7. Phones that cannot move past iOS 16 are the ones that stay on it, and Apple's 16.7.8 update is the last fix on that branch for this bug. If you manage a fleet that includes older iPhones, those are the devices to find first. Anything on iOS 17.5 or later, macOS Sonoma 14.5 or later and the matching releases is past the fix for this one bug, though the campaign uses others.
What The Hacker News's article gets wrong
It gives CVE-2025-43529 for both the WebKit remote code execution and the pointer authentication bypass. Those are different bugs in our reading of Sekoia's chain table, where CVE-2024-27834 is the pointer authentication bypass. We have not seen a second ID for it, and the article does not say which it meant, so check the CVE number against Apple's advisory and not a headline.
What to do
Update iOS, iPadOS, macOS, Safari, tvOS and watchOS to current releases. The fix has been out since May 2024.
Find devices that cannot update. Retire them, or keep them off sensitive logins.
If a device was on iOS 16.7 and browsed the open web during the campaign, rotate the sessions and passwords for anything signed in through Safari.
Check the sites you run for the compromised Plerdy tracker script, which is the other half of our November 4 post.
What we hold
CVE-2024-27834 is in our copy of the KEV catalog, dated November 4. The campaign's network indicators and hashes from Sekoia's report went into the feed on November 4, with the compromised supplier left out on purpose. This listing adds no indicators, so there is nothing new to ingest.
Limits
We read The Hacker News's report and our own KEV copy. We could not read CISA's alert, Apple's advisory or the NVD page. We did not test the bug.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments