CVE-2024-40785: 
Apple Safari vulnerability analysis and mitigation

CVE-2024-40785 is a cross-site scripting (XSS) vulnerability affecting multiple Apple operating systems and software, including iOS 16.7.9, iPadOS 16.7.9, Safari 17.6, iOS 17.6, iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, and macOS Sonoma 14.6. The vulnerability was discovered by Johan Carlsson (joaxcar) and was publicly disclosed on July 29, 2024 (Apple Security).

The vulnerability exists in the WebKit component and occurs when processing maliciously crafted web content, which may lead to a cross-site scripting attack. The issue was addressed with improved checks in WebKit (WebKit Bugzilla: 273805). The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows processing of maliciously crafted web content that may lead to a cross-site scripting attack, potentially compromising user data and web session integrity (Apple Security).

Apple has released security updates to address this vulnerability across multiple platforms. Users should update to iOS 16.7.9, iPadOS 16.7.9, Safari 17.6, iOS 17.6, iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, or macOS Sonoma 14.6, depending on their device (Apple Security).