CVE-2024-27834: Old Safari Bug Now Exploited Against Unpatched iPhones and Macs

Published November 6, 2026. CVE-2024-27834 was added to CISA's exploited-vulnerability list on November 4, 2026.

A Safari bug that Apple fixed back in May 2024 is suddenly back in the news. On November 4, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, which means it now has evidence that attackers are using the flaw in real attacks.

If your iPhone, iPad or Mac has been updated at any point since mid-2024, you're already protected. The people at risk are those still running old, unpatched Apple software, and according to security researchers, a state-backed group has been going after exactly those devices.

CVE-2024-27834: the short version

• What it is: a flaw in WebKit, the engine behind Safari and every iPhone browser, that lets an attacker get around Apple's Pointer Authentication, a hardware defense against memory attacks.
• What's affected: iOS and iPadOS before 16.7.8 and 17.5, macOS before Sonoma 14.5 (and Safari before 17.5 on Monterey and Ventura), tvOS before 17.5 and watchOS before 10.5.
• What an attacker gets: on its own, not much. Chained with a second browser bug, it helps a malicious web page run code on the device.
• Is it being used: yes. CISA added it on November 4, 2026 "based on evidence of active exploitation." The Hacker News, citing Sekoia, links the campaign to the Russia-linked group APT29.
• Severity: CVSS 5.5 (medium), according to The Hacker News and Security Affairs.
• What to do: update to any iOS, iPadOS or macOS release from May 2024 or later. If your device can't get iOS 16.7.8 or newer, it can't be fixed, so stop browsing on it.

What is CVE-2024-27834?

Modern Apple chips have a safety feature called Pointer Authentication (PAC). In plain words, the chip stamps important memory addresses with a cryptographic signature. If malware tampers with one of those addresses to hijack the program, the signature no longer matches and the program stops instead of running the attacker's code. It's one of the main reasons iPhone exploits are so hard to build.

CVE-2024-27834 is a weakness in WebKit that lets an attacker who already has "arbitrary read and write capability" bypass Pointer Authentication, in Apple's own words. CISA files it as an improper authentication flaw (CWE-287). Think of it as a login or permission bypass, except that what's being bypassed is the chip's own check on memory addresses.

That's why the score is only medium: the bug doesn't break into a device by itself. It removes the last safety net once another bug has already given the attacker a foothold inside the browser. For attackers who build full exploit chains, though, a working PAC bypass is a prized piece.

The flaw has a public history. Researcher Manfred Paul used it at the Pwn2Own Vancouver hacking contest in March 2024, chaining it with an integer underflow bug to get remote code execution in Safari, which earned him $60,000, according to BleepingComputer. Apple credited him, working with Trend Micro's Zero Day Initiative, and shipped the fix on May 13, 2024, saying the issue was "addressed with improved checks."

How attackers are exploiting it

For most of the past two years this was just a contest bug with a patch. That changed with CISA's November 4 listing. According to The Hacker News and Security Affairs, which cite research from the security firm Sekoia:

• Attackers paired CVE-2024-27834 with a separate WebKit code-execution flaw, making a chain that worked just by opening a web page, with no taps or downloads needed.
• Victims reached the malicious code in three ways: legitimate websites that had been compromised, fake sites dressed up as popular ones, and a supply-chain compromise of the Plerdy SEO Tracker, a script some websites embed.
• The page's JavaScript profiled the visitor's device first and only went ahead on a suitable target.
• The payload was an information stealer that collects browser and device data, including browser cookies. Stolen cookies can let attackers into your accounts without your password.

Sekoia attributes the activity to APT29 (also known as Cozy Bear or Midnight Blizzard), a group tied to Russia's foreign intelligence service, with "moderate to high confidence," according to The Hacker News. Neither Apple nor CISA has named an attacker, and The Hacker News did not say which device models were hit. Sekoia's report also describes the same actors using other Safari and Chrome bugs that were already patched.

This isn't new behavior. In 2024, Google's Threat Analysis Group reported APT29 using already-patched iPhone and Chrome exploits in watering-hole attacks on Mongolian government websites to steal cookies. The pattern is the same: wait until a fix is out, then go after the people who never installed it.

Am I affected?

You're exposed only if a device is still running software older than these releases, all published by Apple on May 13, 2024:

Anything newer, including every iOS 18, iOS 26 and macOS release since, already has the fix.

Who realistically faces this?

• Most home users: not at risk if automatic updates are on. A phone that has updated even once in the last two years is safe from this bug.
• Old or hand-me-down devices: the real risk. A spare iPhone 8 in a drawer, a kid's old iPad, or a parent's phone that has never been updated may still be on a vulnerable version.
• Devices that can't update: iPhones older than the iPhone 8 never received iOS 16.7.8, according to Apple's device list, so this fix doesn't exist for them.
• Company IT: US federal agencies must fix it by November 18, 2026 under CISA's directive. Other organizations should look for old Apple devices in their fleet, especially ones used for email or admin logins.

How to protect yourself

1. Update now. On iPhone or iPad, go to Settings > General > Software Update and install the latest version. On a Mac, use System Settings > General > Software Update (or System Preferences > Software Update on older Macs).
2. Turn on Automatic Updates in the same screen so security fixes install overnight.
3. Check old devices. Look at Settings > General > About > iOS Version on every spare phone and tablet in the house. Anything below 16.7.8 or 17.5 needs updating.
4. Retire what can't update. If a device can't reach iOS 16.7.8 or later, don't use it for web browsing, email or anything you sign in to.
5. Consider Lockdown Mode if you're a likely target of state-backed hackers (journalists, activists, officials). Apple built it to block many web-based attack techniques.
6. Sign out and back in on sensitive accounts if you think an old device may have been exposed. That invalidates stolen session cookies on many services, and changing passwords adds another layer.

Track every exploited vulnerability

CVE-2024-27834 is one of hundreds of bugs CISA has confirmed attackers are using. The live catalogue at cleus.ai/zero-days lists every one in plain English with what it affects and how to protect yourself. This bug has its own page at cleus.ai/zero-days/CVE-2024-27834, with the official advisory links and CISA's deadline.

CVE-2024-27834 FAQ

Is my iPhone affected by CVE-2024-27834?

Only if it runs a version older than iOS 17.5, or older than iOS 16.7.8 on an iPhone 8, 8 Plus or X. Check Settings > General > About. Any phone that has installed an update since May 2024 already has the fix. Phones older than the iPhone 8 never got a patch for this bug, so they stay exposed.

What is a Safari WebKit vulnerability?

WebKit is the engine that draws web pages in Safari and, on iPhone and iPad, inside every other browser as well, Chrome included. A WebKit vulnerability is a flaw in that engine, so a malicious or hacked web page can attack the device just by being opened. That's why Apple's WebKit fixes ship inside regular iOS and macOS updates.

Why is a bug from 2024 on CISA's list in 2026?

CISA adds a bug when it has evidence of real attacks, whenever that evidence arrives. Researchers reported attackers using this already-patched flaw against devices that never updated. Attackers often go after old bugs because exploits for them are cheaper and many devices are never updated.

Who is exploiting CVE-2024-27834?

According to The Hacker News, the security firm Sekoia attributes the campaign to APT29, a Russia-linked state hacking group, with moderate to high confidence. Apple and CISA haven't named anyone. The attacks reportedly used hacked websites, fake look-alike sites and a compromised website analytics script to deliver a cookie-stealing payload.

Does iOS 26 or iOS 18 fix it?

Yes. The fix arrived in iOS 17.5 and iOS 16.7.8 in May 2024, and every later release, including iOS 18 and iOS 26, includes it. If your device runs any of those, you're protected against CVE-2024-27834 and only need to keep installing new updates as they come.

How serious is CVE-2024-27834?

It's rated CVSS 5.5, which is medium, because it only works once an attacker already has a foothold through another bug. In practice it was the piece that let a full chain succeed, and it's now confirmed in real attacks, so on an unpatched device it's a serious risk.

Do I need antivirus on my iPhone to stay safe?

No. On iPhone and iPad the protection against this kind of attack is the system update itself, because the flaw sits inside Apple's own browser engine. Updating iOS, keeping automatic updates on, and not using devices that can no longer update matter far more than any security app.

Want a quick check on a specific device or setting? Ask Cleus, an uncensored AI assistant that can walk you through finding your version and what to do next.

Sources

• Apple: About the security content of Safari 17.5
• Apple: About the security content of iOS 17.5 and iPadOS 17.5
• Apple: About the security content of iOS 16.7.8 and iPadOS 16.7.8
• Apple: About the security content of macOS Sonoma 14.5
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (Nov 4, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2024-27834
• The Hacker News: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
• Security Affairs: U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog
• BleepingComputer: Apple fixes Safari WebKit zero-day flaw exploited at Pwn2Own
• Google TAG: State-backed attackers and commercial surveillance vendors repeatedly use the same exploits