Apple launched emergency safety updates to repair two zero-day vulnerabilities that had been exploited in assaults on Intel-based Mac methods.
“Apple is aware of a report that this issue may have been exploited,” the corporate mentioned in an advisory issued on Tuesday.
The 2 bugs had been discovered within the macOS Sequoia JavaScriptCore (CVE-2024-44308) and WebKit (CVE-2024-44309) parts of macOS.
The JavaScriptCore CVE-2024-44308 flaw permits attackers to realize distant code execution by way of maliciously crafted internet content material. The opposite flaw, CVE-2024-44309, permits cross-site scripting (CSS) assaults.
The corporate says it addressed the safety flaws in macOS Sequoia 15.1.1.
As the identical parts are present in different Apple working methods, it was additionally mounted in iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, and visionOS 2.1.1.
Whereas Apple says each flaws had been found by Clément Lecigne and Benoît Sevens of Google’s Menace Evaluation Group, the corporate has not supplied additional particulars on how they had been exploited.
BleepingComputer contacted Google to find out how the failings had been exploited however was informed that they don’t have anything extra to share right now.
With these two vulnerabilities, Apple has mounted six zero-days to this point in 2024, with the first in January, two in March, and the fourth in Might.
This quantity is considerably higher than final 12 months when Apple mounted a complete of 20 zero-day flaws exploited within the wild, together with:
