Apple CVE-2024-27834 Added to CISA KEV as a 2024 WebKit Flaw Turns Up in an iPhone Cookie-Theft Chain

CISA added CVE-2024-27834, a WebKit flaw Apple fixed in May 2024, on its Known Exploited Vulnerabilities catalogue on 4 November, citing evidence of active exploitation. US federal agencies must patch by 18 November. The same day, Sekoia published research tying the bug to an exploit chain that steals cookies from iPhones still on older iOS releases.

What the bug does

Apple's advisory gives the impact: "an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication", the hardware check meant to stop hijacked code pointers. It's a second-stage bug, useful only once another flaw has given the attacker memory access. Apple credits Manfred Paul, working with Trend Micro's Zero Day Initiative, with the report. NVD scores it 5.5, medium, and CISA says ransomware use is "Unknown".

The watering-hole campaign

Sekoia's write-up places the flaw in a chain that "incorporates a PAC bypass utilizing CVE-2024-27834" after a first stage built on CVE-2025-43529. The delivery server picked out iOS 16.7, though the exploits "should work from 16.0 to 17.4", and the goal was the phone's cookies. Sekoia attributes the campaign "with moderate to high confidence" to APT29.

The code reached victims through Plerdy, a Ukrainian analytics service whose tracking script was poisoned between 27 August and 3 September 2026. Help Net Security notes that script "runs on thousands of websites, most of them Ukrainian". An Android chain used CVE-2026-3910 and CVE-2025-27038 against Chrome cookies and Wi-Fi passwords.

CISA didn't name an attacker or tie the listing to Sekoia's findings. BleepingComputer reports that the chains install nothing that survives, so a reboot ends the infection until the device lands on a poisoned site again.

Fixed versions

Sekoia says "a user running an up-to-date operating system is safe from these attacks". The May 2024 fixes for CVE-2024-27834 are:

• iPhone XS and later: iOS and iPadOS 17.5
• iPhone 8, 8 Plus and X, iPad 5th generation, first iPad Pro models: iOS and iPadOS 16.7.8
• Mac: macOS Sonoma 14.5, or Safari 17.5 on Monterey and Ventura
• Apple TV: tvOS 17.5; Apple Watch Series 4 and later: watchOS 10.5