CISA flags 18-month-old Apple WebKit flaw CVE-2024-27834 as actively exploited

CISA has added CVE-2024-27834, an Apple authentication flaw in WebKit that was fixed in May 2024, to its Known Exploited Vulnerabilities catalog. The November 4, 2026 listing signals that the bug is being used in real attacks, roughly eighteen months after patches shipped.

An old bug, quietly chained

The catalog entry is brief: an improper authentication vulnerability affecting multiple Apple products. As a writeup on dev.to explains, the flaw sits in WebKit and lets an attacker who has already gained the ability to read and write arbitrary memory sidestep Pointer Authentication Codes, the hardware-backed check meant to stop memory corruption from becoming code execution. Its CVSS base score of 5.5 reads as medium, and in isolation that is reasonable, since exploiting it requires a separate bug to obtain the underlying memory access first.

Apple released fixes on May 13, 2024 in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5, with iOS 16.7.8 covering older hardware. The company credited researcher Manfred Paul, working with Trend Micro's Zero Day Initiative, and the bug had been demonstrated live at Pwn2Own Vancouver in March 2024.

What triggered the listing

The KEV addition follows research from Sekoia, whose analysts Amaury-Jacques Garcon and Felix Aime documented a campaign they call Poisoned Source, discovered in mid-October 2026 and attributed with moderate-to-high confidence to APT29, the group linked to Russia's foreign intelligence service. According to Sekoia's findings as recounted by the dev.to post, the campaign delivers mobile exploits through three routes:

• Legitimate websites that were breached and seeded with injected JavaScript, reportedly including a US chemical industry trade association, a far-right European political party and a Bulgaria-based military-related site.
• Lookalike domains imitating prominent sites in the US, Ukraine, the Czech Republic and Bulgaria, one of them posing as an official US anniversary celebration page.
• A supply-chain compromise of Plerdy, a Ukrainian web analytics service: between August 27 and September 3, 2026, attackers planted malicious code in a JavaScript file that Plerdy's customers embed on their own sites, extending the campaign's reach without breaking into each site individually.

How the chains work

Sekoia reports that the injected script fingerprints each visitor's device and browser, after which the delivery infrastructure selects an exploit path. One chain targets iOS 16.7 by pairing a WebKit remote code execution flaw, CVE-2025-43529, with the CVE-2024-27834 PAC bypass to run JavaScript malware that harvests browser cookies. A second, aimed at iOS 18.5, uses a five-vulnerability sequence Sekoia names DarkSword to extract a far broader haul: SMS and iMessage content, mail databases, WhatsApp and Telegram data, iCloud Keychain entries, Wi-Fi passwords, contacts, call history, photos, Health, Calendar, Notes and iCloud Drive files. A third chain hits Chrome on Android versions 139 through 145, installing a payload Sekoia calls AndroSnitch to siphon browser data and Wi-Fi passwords; oddly, it aborts if the device identifies as a Samsung Galaxy S25 Ultra. Exfiltrated data is sent to a telemetry endpoint Sekoia published.

Victims do not need to tap anything. These are watering-hole attacks: loading an infected page on an unpatched phone is enough.

Why it matters

Every vulnerability in these chains already had a patch while the campaign was running, and CVE-2024-27834 had been fixed for about a year and a half. Sekoia argues this reflects the current economics of attack: packaged n-day chains, originally built by commercial surveillance vendors and later reused by state actors, cut the cost and skill needed for advanced mobile exploitation. There is no need for a fresh zero-day when enough phones still run outdated software.

The episode also shows the limits of severity scoring. A CVSS 5.5 bug that appears to merely weaken a mitigation looks skippable in triage, but placed behind a remote code execution flaw it becomes the gap between a crashed browser and stolen credentials. CVSS grades bugs in isolation; attackers deploy them in combination.

Two caveats the research itself raises: the APT29 attribution is an assessment, not established fact, and Sekoia says it is unclear whether the campaign targeted specific high-value visitors or simply compromised as many unpatched devices as possible.

What to do

• Update iPhones, iPads, Macs and Android devices to the current OS, and Chrome to the latest release, with automatic updates enabled.
• Reboot phones periodically; per Sekoia, these chains generally do not persist, so a restart clears the implant from memory.
• High-risk users such as journalists, activists and officials should consider Apple's Lockdown Mode.
• Website operators should audit third-party analytics and tag scripts, since the Plerdy incident shows visitor safety now hinges on vendor hygiene.

US federal agencies must remediate CVE-2024-27834 by November 18, 2026 under CISA's Binding Operational Directive 26-04. For everyone else, the practical deadline is whatever the attackers decide.