A malicious website may exfiltrate data cross-origin & other Fixes

Safari 18
Released September 16, 2024
Security Update:

WebKit

• Available for: macOS Ventura and macOS Sonoma
• Impact: Visiting a malicious website may lead to address bar spoofing
• Description: The issue was addressed with improved UI.
• WebKit Bugzilla: 279451
• CVE-2024-40866: Hafiizh and YoKo Kho (@yokoacc) of HakTrak

WebKit

• Available for: macOS Ventura and macOS Sonoma
• Impact: A malicious website may exfiltrate data cross-origin
• Description: A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins.
• WebKit Bugzilla: 279452
• CVE-2024-44187: Narendra Bhati, Manager of Cyber Security at Suma Soft Pvt. Ltd, Pune (India)

WebKit

• Available for: macOS Ventura and macOS Sonoma
• Impact: Processing maliciously crafted web content may lead to universal cross site scripting
• Description: This issue was addressed through improved state management.
• WebKit Bugzilla: 268724
• CVE-2024-40857: Ron Masas