Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R U L L L 6.3 .2259 97.7 YES
AFFECTED Product Versions Fixed Safari unspecified — iOS and iPadOS unspecified — macOS unspecified — visionOS unspecified —
TIMELINE Aug 20 Reserved by apple Nov 19 Published (CNA: apple) Nov 21 Added to CISA KEV, remediation due 2024-12-12
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
| Date | Event | Detail |
|---|---|---|
| August 20, 2024 | Reserved | Reserved by apple |
| November 19, 2024 | Published | Published (CNA: apple) |
| November 21, 2024 | KEV ADDED | Added to CISA KEV, remediation due 2024-12-12 |
Authoritative record: CVE-2024-44309 at cve.org
Vendors: apple
Weaknesses: CWE-79
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-44309 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
