Login Sign Up

CVE-2024-40867

9.6 CRITICAL

📋 TL;DR

This vulnerability allows remote attackers to escape the Web Content sandbox on iOS/iPadOS devices through improper custom URL scheme handling. Attackers could potentially execute arbitrary code in a privileged context. All iOS/iPadOS users running versions before 18.1 are affected.

💻 Affected Systems

Products:
  • iOS
  • iPadOS
Versions: All versions before iOS 18.1 and iPadOS 18.1
Operating Systems: iOS, iPadOS
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all devices running vulnerable iOS/iPadOS versions. No special configuration required for exploitation.

📦 What is this software?

Ipados by Apple

View all CVEs affecting Ipados →

Iphone Os by Apple

View all CVEs affecting Iphone Os →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise allowing installation of persistent malware, data theft, and unauthorized access to sensitive information and device functions.

🟠

Likely Case

Limited sandbox escape allowing access to some privileged resources, potentially leading to data leakage or limited system manipulation.

🟢

If Mitigated

Attack fails due to proper input validation, maintaining Web Content sandbox isolation with no impact.

🌐 Internet-Facing: HIGH - Remote attackers can exploit via malicious web content without user interaction beyond visiting a compromised site.
🏢 Internal Only: MEDIUM - Requires user to access malicious content, but internal phishing or compromised sites could facilitate exploitation.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires crafting malicious web content but no authentication. No public exploit code identified yet.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: iOS 18.1 and iPadOS 18.1

Vendor Advisory: https://support.apple.com/en-us/121563

Restart Required: Yes

Instructions:

1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install iOS 18.1/iPadOS 18.1. 5. Restart device when prompted.

🔧 Temporary Workarounds

Disable JavaScript in Safari

all

Prevents execution of malicious JavaScript that could trigger the vulnerability

Settings > Safari > Advanced > JavaScript > Toggle Off

Use alternative browser with sandboxing

all

Switch to browsers that may not be affected by iOS-specific URL scheme handling

🧯 If You Can't Patch

  • Restrict web browsing to trusted sites only using content filtering
  • Implement mobile device management (MDM) policies to restrict URL scheme handling

🔍 How to Verify

Check if Vulnerable:

Check iOS/iPadOS version in Settings > General > About > Software Version. If version is earlier than 18.1, device is vulnerable.

Check Version:

Settings > General > About > Software Version

Verify Fix Applied:

After update, verify version shows 18.1 or later in Settings > General > About > Software Version.

📡 Detection & Monitoring

Log Indicators:

  • Unusual URL scheme invocations in web browsing logs
  • Sandbox violation alerts in system logs

Network Indicators:

  • Requests to known malicious domains hosting exploit code
  • Unusual outbound connections after web browsing

SIEM Query:

source="ios_logs" AND (event="sandbox_violation" OR url_scheme="custom:*")

📊 Metadata

CVE ID: CVE-2024-40867
CVSS v3 Score: 9.6 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Published: October 28, 2024
Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON