{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "apple-webkit-pointer-auth-cve-2024-27834",
  "url": "https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834/",
  "path": "/incidents/apple-webkit-pointer-auth-cve-2024-27834/",
  "json_url": "https://patchgap.ai/incidents/apple-webkit-pointer-auth-cve-2024-27834.json",
  "title": "Mac, Safari, and iPhone: CISA says an old Apple bug is being used in real attacks. Update if you missed May 2024 fixes.",
  "category": "browsers",
  "platforms": [
   "macos",
   "ios"
  ],
  "products": [
   "safari",
   "macos",
   "iphone-ios"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists it as used in real attacks (added Nov 4, 2026).",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2024-05-13",
  "updated_at": "2026-11-04",
  "cves": [
   "CVE-2024-27834"
  ],
  "summary": "Apple fixed a browser engine bug in May 2024. On November 4, 2026, CISA said that bug is being used in real attacks. If you installed Apple updates from May 2024 or later, you already have the fix. This mainly matters for a Mac, iPhone, or iPad that has not updated since before mid-May 2024.",
  "am_i_affected": "You are at risk only if your device never got the May 2024 updates: Safari older than 17.5, macOS Sonoma older than 14.5 (or Ventura older than 13.6.7, Monterey older than 12.7.5), or iPhone/iPad older than iOS 17.5 / 16.7.8. On a Mac check Apple menu > About This Mac and Safari > About Safari. On an iPhone go to Settings > General > About.",
  "action": "Install any Apple update from May 2024 or later (most people already did)",
  "affected": [
   {
    "product": "safari",
    "product_name": "Safari",
    "platform": "macos",
    "affected_versions": "Safari before 17.5 (on macOS Monterey and Ventura standalone Safari updates)",
    "fixed_version": "Safari 17.5",
    "fixed_min": "17.5",
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/120896"
    ],
    "check": {
     "menu_path": "Open Safari. Menu bar: Safari > About Safari.",
     "command": "mdls -name kMDItemVersion \"/Applications/Safari.app\"",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.apple.com/en-us/108382"
   },
   {
    "product": "macos",
    "product_name": "macOS",
    "platform": "macos",
    "affected_versions": "macOS Sonoma before 14.5; Ventura before 13.6.7; Monterey before 12.7.5",
    "fixed_version": "14.5 (Sonoma) / 13.6.7 (Ventura) / 12.7.5 (Monterey)",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/120903",
     "https://support.apple.com/en-us/120900",
     "https://support.apple.com/en-us/120899"
    ],
    "check": {
     "menu_path": "Apple menu > About This Mac. Or Apple menu > System Settings > General > Software Update.",
     "command": "sw_vers -productVersion",
     "shell": "Terminal",
     "read_only": true
    },
    "official_download": "https://support.apple.com/en-us/108382"
   },
   {
    "product": "iphone-ios",
    "product_name": "iPhone and iPad (iOS)",
    "platform": "ios",
    "affected_versions": "iOS/iPadOS before 17.5, and older devices before 16.7.8",
    "fixed_version": "iOS/iPadOS 17.5 or 16.7.8",
    "fixed_min": null,
    "fix_note": null,
    "fixed_source_urls": [
     "https://support.apple.com/en-us/120905",
     "https://support.apple.com/en-us/120898"
    ],
    "check": {
     "menu_path": "On your iPhone: Settings > General > About to see your version. Settings > General > Software Update to update.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://support.apple.com/en-us/100100"
   }
  ],
  "fix_steps": [
   "On a Mac: Apple menu > System Settings > General > Software Update, then install what it offers and restart if asked.",
   "On an iPhone or iPad: Settings > General > Software Update, then install what it offers.",
   "If Safari updates on its own for older Macs: open Software Update the same way, or open Safari > About Safari after updating."
  ],
  "official_patch_links": [
   {
    "label": "Apple: update macOS on your Mac",
    "url": "https://support.apple.com/en-us/108382"
   },
   {
    "label": "Apple: update your iPhone or iPad",
    "url": "https://support.apple.com/en-us/100100"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://support.apple.com/en-us/120896",
    "title": "Apple: About the security content of Safari 17.5",
    "date": "2024-05-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/120903",
    "title": "Apple: About the security content of macOS Sonoma 14.5",
    "date": "2024-05-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/120900",
    "title": "Apple: About the security content of macOS Ventura 13.6.7",
    "date": "2024-05-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/120899",
    "title": "Apple: About the security content of macOS Monterey 12.7.5",
    "date": "2024-05-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/120905",
    "title": "Apple: About the security content of iOS 17.5 and iPadOS 17.5",
    "date": "2024-05-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://support.apple.com/en-us/120898",
    "title": "Apple: About the security content of iOS 16.7.8 and iPadOS 16.7.8",
    "date": "2024-05-13",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2024-27834 (added 2026-11-04)",
    "date": "2026-11-04",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog",
    "title": "CISA alert: Adds One Known Exploited Vulnerability to Catalog (CVE-2024-27834)",
    "date": "2026-11-04",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27834",
    "title": "NVD: CVE-2024-27834",
    "date": "2024-05-14",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}