The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a security vulnerability in several Apple operating systems that is currently being actively exploited. This medium-severity flaw, known as CVE-2024-27834, was added to CISA’s Known Exploited Vulnerabilities catalog on Wednesday. The flaw allows potential attackers to bypass Pointer Authentication, posing significant risks.
Details of the Vulnerability
CVE-2024-27834 is a vulnerability related to improper authentication, which can provide attackers with arbitrary read and write capabilities. Apple addressed this issue in May 2024, implementing improved security checks across various platforms, including iOS 16.7.8, iPadOS 16.7.8, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The flaw was initially demonstrated as a zero-day vulnerability during the Pwn2Own Vancouver contest in March 2024.
Exploitation Tactics and Attribution
Recent reports indicate that threat actors, potentially linked to Russian entities, have been exploiting previously patched vulnerabilities in Safari and Google Chrome. The group behind these attacks, known as APT29 or Cozy Bear, has been linked to Russia’s Foreign Intelligence Service. Their methods involve exploiting legitimate websites, fake sites, and a supply chain attack targeting Plerdy SEO Tracker to deploy malware that harvests browser and device data.
Technical Aspects of the Exploit
The attack chain utilizes a combination of exploits, including CVE-2025-43529, a remote code execution flaw in WebKit, and a Pointer Authentication Codes (PACs) bypass, to execute malicious JavaScript payloads. These payloads are designed to steal browser cookies and sensitive information from the victim’s device without any user interaction.
In response to these threats, Federal Civilian Executive Branch (FCEB) agencies are urged to implement the necessary security patches by November 18, 2026, to mitigate potential risks associated with this vulnerability.
As cyber threats continue to evolve, staying informed about vulnerabilities and applying timely security updates remain crucial in safeguarding personal and organizational data.
