CVE-2024-27844: 
Apple Safari vulnerability analysis and mitigation

CVE-2024-27844 is a security vulnerability affecting Apple's Safari browser, visionOS, and macOS Sonoma operating systems. The vulnerability was discovered by Narendra Bhati of Suma Soft Pvt. Ltd in Pune (India) and Shaheen Fazim, and was publicly disclosed on June 10, 2024. The issue allows a website's permission dialog to persist after navigation away from the site. This vulnerability has been fixed in visionOS 1.2, macOS Sonoma 14.5, and Safari 17.5 (Apple Support).

The vulnerability was addressed with improved checks in the affected systems. The issue received a CVSS 3.1 Base Score of 5.5 (MEDIUM) from NVD with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Additionally, CISA-ADP assessed it with a higher CVSS 3.1 Base Score of 9.1 (CRITICAL) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability could allow a malicious website to maintain its permission dialog even after a user navigates away from the site, potentially leading to security implications for user permissions and privacy (Apple Support).

The vulnerability affects multiple versions of Apple's software including Safari versions up to (excluding) 17.5, macOS versions from 14.0 up to (excluding) 14.5, and visionOS versions up to (excluding) 1.2 (NVD).

Apple has released patches to address this vulnerability in Safari 17.5, macOS Sonoma 14.5, and visionOS 1.2. Users are advised to update their systems to these versions or later to mitigate the vulnerability (Apple Support, Apple Support, Apple Support).