Apple launched emergency safety updates to repair two zero-day vulnerabilities that had been exploited in assaults on Intel-based Mac methods.
“Apple is conscious of a report that this difficulty might have been exploited,” the corporate mentioned in an advisory issued on Tuesday.
The 2 bugs had been discovered within the macOS Sequoia JavaScriptCore (CVE-2024-44308) and WebKit (CVE-2024-44309) parts of macOS.
The JavaScriptCore CVE-2024-44308 flaw permits attackers to attain distant code execution by maliciously crafted internet content material. The opposite flaw, CVE-2024-44309, permits cross-site scripting (CSS) assaults.
The corporate says it addressed the safety flaws in macOS Sequoia 15.1.1.
As the identical parts are present in different Apple working methods, it was additionally fastened in iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, and visionOS 2.1.1.
Whereas Apple says each flaws had been found by Clément Lecigne and Benoît Sevens of Google’s Risk Evaluation Group, the corporate has not offered additional particulars on how they had been exploited.
BleepingComputer contacted Google to learn the way the issues had been exploited however was informed that they don’t have anything extra to share right now.
With these two vulnerabilities, Apple has fastened six zero-days up to now in 2024, with the first in January, two in March, and the fourth in Might.
This quantity is considerably higher than final yr when Apple fastened a complete of 20 zero-day flaws exploited within the wild, together with: