EXPOSURES › CVE-2025-24201
CVE-2025-24201
HIGH ⌖ ON CISA KEV · EXPLOITEDA WebKit out-of-bounds write vulnerability in Apple products allows malicious web content to escape the sandbox, actively exploited in the wild and impacting DIB organizations using Apple devices or WebKit-dependent software.
This vulnerability in Apple's WebKit, affecting iOS, iPadOS, and macOS, enables malicious web content to break out of its intended sandbox, potentially leading to system compromise. DIB organizations relying on Apple products or WebKit-based software must immediately patch to prevent exploitation and maintain NIST 800-171 compliance.
Shame score — The active exploitation of a sandbox escape vulnerability in widely used Apple products demonstrates a significant security oversight with potential for widespread compromise.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.