This vulnerability (CVE-2024-44309) involves a cookie management issue in QtWebKit's WebKitGTK port that was addressed by improving state management to prevent data isolation bypass. The flaw could be exploited via malicious web content to perform cross-site scripting attacks. Apple fixed the issue in Safari 18.1.1, iOS 17.7.2, iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1, iPadOS 18.1.1, and visionOS 2.1.1. Red Hat and Ubuntu advisories confirm patches are available in WebKitGTK versions 2.46.4 and later. The CVSS v3.1 base score is 6.3 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is awareness of possible active exploitation on Intel-based Macs.

Successful exploitation may allow an attacker to execute cross-site scripting attacks by bypassing cookie and state isolation mechanisms. This can lead to partial compromise of confidentiality, integrity, and availability of affected systems. The vulnerability affects multiple platforms using QtWebKit/WebKitGTK, including Apple operating systems and Linux distributions such as Red Hat Enterprise Linux and Ubuntu. Active exploitation has been reported on Intel-based Mac systems, increasing the urgency of applying patches.

Patches are available and should be applied promptly. Apple has released fixes in Safari 18.1.1, iOS 17.7.2, iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1, iPadOS 18.1.1, and visionOS 2.1.1. Red Hat has issued updated webkit2gtk3 packages (version 2.46.3-2.el9_5 and later) addressing this issue. Ubuntu has released updates to WebKitGTK packages version 2.46.4-0ubuntu0.* for supported releases including 22.04 LTS, 24.04 LTS, and 24.10. Users should update their systems and restart applications using WebKitGTK (e.g., Epiphany) to complete remediation. No vendor advisory states that no action is required; therefore, applying official patches is the recommended mitigation.