{"id":"CVE-2024-44187","state":"PUBLISHED","title":"A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Se","description":"A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.","publishedAt":"2024-09-16T23:23:16.230Z","updatedAt":"2026-04-02T18:24:29.919Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"apple","products":["Apple Safari","Apple iOS and iPadOS","Apple macOS","Apple tvOS","Apple visionOS","Apple watchOS"],"affected":[{"vendor":"Apple","product":"Safari","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]},{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"15","versionType":"custom"}]},{"vendor":"Apple","product":"tvOS","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","status":"affected","lessThan":"2","versionType":"custom"}]},{"vendor":"Apple","product":"watchOS","versions":[{"version":"0","status":"affected","lessThan":"11","versionType":"custom"}]}],"references":["https://support.apple.com/en-us/121238","https://support.apple.com/en-us/121240","https://support.apple.com/en-us/121241","https://support.apple.com/en-us/121248","https://support.apple.com/en-us/121249","https://support.apple.com/en-us/121250","https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html","http://seclists.org/fulldisclosure/2024/Sep/37","http://seclists.org/fulldisclosure/2024/Sep/36","http://seclists.org/fulldisclosure/2024/Sep/33","http://seclists.org/fulldisclosure/2024/Sep/32"],"weaknesses":["CWE-346"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/44xxx/CVE-2024-44187.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-44187","state":"PUBLISHED","datePublished":"2024-09-16T23:23:16.230Z","dateUpdated":"2026-04-02T18:24:29.919Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2024-08-20T21:42:05.933Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin."}],"affected":[{"vendor":"Apple","product":"Safari","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]},{"vendor":"Apple","product":"iOS and iPadOS","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]},{"vendor":"Apple","product":"macOS","versions":[{"version":"0","status":"affected","lessThan":"15","versionType":"custom"}]},{"vendor":"Apple","product":"tvOS","versions":[{"version":"0","status":"affected","lessThan":"18","versionType":"custom"}]},{"vendor":"Apple","product":"visionOS","versions":[{"version":"0","status":"affected","lessThan":"2","versionType":"custom"}]},{"vendor":"Apple","product":"watchOS","versions":[{"version":"0","status":"affected","lessThan":"11","versionType":"custom"}]}],"references":[{"url":"https://support.apple.com/en-us/121238"},{"url":"https://support.apple.com/en-us/121240"},{"url":"https://support.apple.com/en-us/121241"},{"url":"https://support.apple.com/en-us/121248"},{"url":"https://support.apple.com/en-us/121249"},{"url":"https://support.apple.com/en-us/121250"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"A malicious website may exfiltrate data cross-origin"}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2026-04-02T18:24:29.919Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-09-17T13:44:18.458972Z","id":"CVE-2024-44187","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","type":"CWE","lang":"en","description":"CWE-346 Origin Validation Error"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-14T15:25:26.428Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00019.html"},{"url":"http://seclists.org/fulldisclosure/2024/Sep/37"},{"url":"http://seclists.org/fulldisclosure/2024/Sep/36"},{"url":"http://seclists.org/fulldisclosure/2024/Sep/33"},{"url":"http://seclists.org/fulldisclosure/2024/Sep/32"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T16:15:32.974Z"}}]}}}