CVE-2024-40817

Published: Jul 29, 2024Modified: Apr 2, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Visiting a website that frames malicious content may lead to UI spoofing.

Affected (4)

Products: Apple: Macos, Safari

Apple

2 products

Macos

Safari

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	From 12.0 to 12.7.6
Apple Macos	From 13.0 to 13.6.8
Apple Macos	From 14.0 to 14.6
Apple Safari	Before 17.6

Related CWEs

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

References (16)

https://support.apple.com/en-us/120910

Source: product-security@apple.com

https://support.apple.com/en-us/120911

Source: product-security@apple.com

https://support.apple.com/en-us/120912

Source: product-security@apple.com

https://support.apple.com/en-us/120913

Source: product-security@apple.com

http://seclists.org/fulldisclosure/2024/Jul/15