CVE-2024-27838: A maliciously crafted webpage may be able to fingerprint the user in Apple Safari
CVE-2024-27838 is a medium severity vulnerability in Apple Safari that allows a maliciously crafted webpage to fingerprint the user. This issue was addressed by Apple through additional logic to prevent fingerprinting. The vulnerability is fixed in Safari 17. 5 and corresponding updates to iOS, iPadOS, macOS Sonoma, tvOS, visionOS, and watchOS. The CVSS score is 6. 5, indicating a moderate impact primarily on user privacy due to fingerprinting. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
CVE-2024-27838 is a vulnerability in Apple Safari where a maliciously crafted webpage may be able to fingerprint the user, potentially compromising user privacy. Apple fixed this issue by adding additional logic to Safari and related OS versions, including Safari 17.5, iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. The vulnerability has a CVSS 3.1 base score of 6.5, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The issue is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Potential Impact
A malicious webpage could fingerprint users in Safari, potentially enabling tracking or profiling based on browser behavior or characteristics. There is no confidentiality or availability impact reported, but the integrity impact is rated high, indicating potential manipulation or influence on user experience or data integrity. No known exploits in the wild have been reported.
Mitigation Recommendations
Apple has released official patches fixing this vulnerability in Safari 17.5 and related OS updates including iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Users and administrators should apply these updates promptly to mitigate the risk. Patch status is confirmed as fixed by Apple’s official security advisories.
CVE-2024-27838: A maliciously crafted webpage may be able to fingerprint the user in Apple Safari
Description
CVE-2024-27838 is a medium severity vulnerability in Apple Safari that allows a maliciously crafted webpage to fingerprint the user. This issue was addressed by Apple through additional logic to prevent fingerprinting. The vulnerability is fixed in Safari 17. 5 and corresponding updates to iOS, iPadOS, macOS Sonoma, tvOS, visionOS, and watchOS. The CVSS score is 6. 5, indicating a moderate impact primarily on user privacy due to fingerprinting. No known exploits are reported in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-27838 is a vulnerability in Apple Safari where a maliciously crafted webpage may be able to fingerprint the user, potentially compromising user privacy. Apple fixed this issue by adding additional logic to Safari and related OS versions, including Safari 17.5, iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. The vulnerability has a CVSS 3.1 base score of 6.5, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The issue is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Potential Impact
A malicious webpage could fingerprint users in Safari, potentially enabling tracking or profiling based on browser behavior or characteristics. There is no confidentiality or availability impact reported, but the integrity impact is rated high, indicating potential manipulation or influence on user experience or data integrity. No known exploits in the wild have been reported.
Mitigation Recommendations
Apple has released official patches fixing this vulnerability in Safari 17.5 and related OS updates including iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Users and administrators should apply these updates promptly to mitigate the risk. Patch status is confirmed as fixed by Apple’s official security advisories.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apple
- Date Reserved
- 2024-02-26T15:32:28.528Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 690a3b65ff58c9332ff09ef1
Added to database: 11/4/2025, 5:44:05 PM
Last enriched: 4/9/2026, 11:16:59 PM
Last updated: 5/10/2026, 3:14:01 AM
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.