CVE-2024-23254 is a WebKit vulnerability impacting Apple Safari and related platforms that allows a malicious website to exfiltrate audio data across origins by bypassing Content Security Policy enforcement. The root cause was a logic issue in WebKit's handling of UI and CSP validation. Apple fixed this vulnerability by improving UI handling and validation mechanisms. The fix is included in Safari 17.4 and corresponding OS updates released in March 2024. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction required, and high confidentiality impact but no integrity or availability impact.

The vulnerability allows a remote attacker controlling a malicious website to bypass Content Security Policy enforcement in Safari and related WebKit-based browsers, potentially enabling cross-origin exfiltration of audio data. This compromises user privacy by allowing unauthorized access to audio streams. There is no indication of integrity or availability impact. No known active exploitation has been reported. The impact is limited to confidentiality loss of audio data accessible via the browser.

Apple has released official patches addressing this vulnerability in Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. Users and administrators should apply these updates promptly to remediate the issue. Since this is a client-side browser vulnerability, updating the affected Apple operating systems and Safari versions is the primary mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.