cbcvebase.
CVE-2025-24201
published 2025-03-11

CVE-2025-24201: An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS…

PriorityP191critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-04-03
Exploited in the wild
EPSS
4.24%
89.9th percentile
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web content may be able to break out of Web Content sandbox. This is a supplementary fix for an attack that was blocked in iOS 17.2. (Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2.).

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
appleios_15.8.4_and_ipados
appleios_16.7.11_and_ipados
appleios_18.3.2_and_ipados
appleios_and_ipados< 15.8.415.8.4
appleios_and_ipados< 16.7.1116.7.11
appleios_and_ipados< 18.3.218.3.2
appleipados< 17.7.617.7.6
appleipados
appleipados>= 15.8 < 15.8.415.8.4
appleipados>= 16.7 < 16.7.1116.7.11
appleipados>= 17.0 < 17.7.617.7.6
appleipados>= 18.0 < 18.3.218.3.2
appleiphone_os>= 15.8 < 15.8.415.8.4
appleiphone_os>= 16.7 < 16.7.1116.7.11
appleiphone_os>= 17.0 < 18.3.218.3.2
applemacos< 15.3.215.3.2
applemacos>= 15.0 < 15.3.215.3.2
applemacos_sequoia
applesafari< 18.3.118.3.1
applesafari
applevisionos< 2.3.22.3.2
applevisionos
applewatchos< 11.411.4
applewatchos
chromiumchromium>= 0 < 134.0.6998.88-1~deb12u1134.0.6998.88-1~deb12u1

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2025-24201 is an out-of-bounds write in WebKit (GPU/Web Content sandbox escape); look for maliciously crafted web content triggering sandbox breakout from the WebKit Web Content process
  • The vulnerability is specifically classified as an out-of-bounds write in the GPU component on Mac within Chromium/WebKit; monitor GPU process activity originating from web content rendering
  • Active in-the-wild exploitation confirmed; treat any unexplained WebKit Web Content sandbox escape on iOS versions prior to iOS 17.2 as a high-confidence indicator of this attack chain
  • This is a supplementary fix for an attack vector that was partially blocked in iOS 17.2; investigate devices running iOS < 17.2 for signs of prior exploitation, as the original attack predates the supplementary patch
  • Google confirmed exploit existence in the wild; Microsoft Edge (Chromium-based) versions prior to 134.0.3124.62 (based on Chromium 134.0.6998.89) are vulnerable — flag unpatched Edge versions in enterprise environments
  • ·Exploitation has been described as 'extremely sophisticated' and highly targeted; mass exploitation is not currently reported, but patching is still strongly advised for all users
  • ·The affected component is WebKit (Web Content sandbox / GPU process); the vulnerability manifests only when processing maliciously crafted web content, not through other attack surfaces

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
osv10.0CRITICAL
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_msrc10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.