TL;DR
- The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on 5 November 2026, setting a mandatory compliance deadline of 18 November 2026 for Federal Civilian Executive Branch agencies.
- CVE-2024-27834 is a medium-severity (CVSS 5.5) improper authentication vulnerability in Apple platforms that enables attackers with arbitrary read and write capabilities to bypass Pointer Authentication (PAC).
- Threat intelligence research by Sekoia attributes active exploitation with moderate to high confidence to APT29 (Cozy Bear / Midnight Blizzard), a state-sponsored group linked to Russia’s Foreign Intelligence Service (SVR).
- The attack uses a zero-click exploit chain combining WebKit remote code execution flaw CVE-2025-43529 with PAC bypass CVE-2024-27834 to execute a JavaScript payload designed for browser cookie theft.
- Delivery pathways include compromised legitimate sites, spoofed domains, and a supply chain compromise of the Plerdy SEO Tracker service to profile visitors and deploy info-stealer payloads.
- Apple remediated CVE-2024-27834 in May 2024 across iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. Unpatched corporate endpoints remain exposed to session hijacking.
The Cybersecurity and Infrastructure Security Agency (CISA) added cve-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on 5 November 2026 following confirmed reports of active in-the-wild exploitation by state-sponsored actors. The vulnerability represents an improper authentication flaw in Apple operating systems that allows an attacker who has already achieved arbitrary memory read and write capabilities to bypass hardware-enforced Pointer Authentication (PAC). By neutralising this integrity check, attackers turn a constrained renderer compromise into full control-flow hijacking.
Threat research from Sekoia links this active cyber espionage campaign to APT29 (also tracked as Cozy Bear, Midnight Blizzard, and affiliated with Russia’s Foreign Intelligence Service, the SVR). The group deployed a multi-stage, zero-click exploit chain that combines WebKit remote code execution (RCE) vulnerability CVE-2025-43529 with the PAC bypass provided by CVE-2024-27834. According to reporting by The Hacker News, the campaign compromised legitimate websites, established fake portals, and compromised the third-party Plerdy SEO Tracker supply chain to target enterprise visitors.
Although Apple released patches for CVE-2024-27834 in May 2024, unpatched legacy mobile devices and desktop endpoints remain widespread across enterprise environments. Because the payload specifically targets browser cookies and session tokens, successful exploitation allows attackers to bypass primary authentication checks and Multi-Factor Authentication (MFA) enforcement across corporate Single Sign-On (SSO) infrastructure. Security operations teams must prioritize verifying operating system versions and auditing web script integrations across managed fleets.
CISA Adds Apple PAC Bypass CVE-2024-27834 to KEV Catalog
On Wednesday, 5 November 2026, CISA formally integrated CVE-2024-27834 into its KEV catalog. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must apply vendor updates by 18 November 2026. While the mandate applies directly to federal agencies, commercial security operations teams frequently use the KEV catalog as an authoritative baseline for enterprise patch prioritization.
CVE-2024-27834 carries a Common Vulnerability Scoring System (CVSS) v3 base score of 5.5. Although rated as medium severity due to requiring an initial execution capability (such as an arbitrary memory read/write primitive), its operational impact is high when paired with a browser engine vulnerability. The flaw was first publicly demonstrated as a zero-day exploit at the Pwn2Own Vancouver hacking competition in March 2024, where security researchers demonstrated its capability to neutralise platform mitigation controls on fully patched Apple hardware.
Apple published patches addressing CVE-2024-27834 in May 2024 by implementing strengthened state validation checks within platform frameworks. The comprehensive remediation covered seven operating systems and Apple’s standalone browser engine distribution:
| Target Platform | Remediated Version | Initial Patch Availability |
|---|---|---|
| iOS | 16.7.8 and 17.5 | May 2024 |
| iPadOS | 16.7.8 and 17.5 | May 2024 |
| macOS Sonoma | 14.5 | May 2024 |
| tvOS | 17.5 | May 2024 |
| watchOS | 10.5 | May 2024 |
| Safari | 17.5 | May 2024 |
Despite the availability of fixes since May 2024, Sekoia’s telemetry confirmed active exploitation targeting legacy versions of Safari and Google Chrome on Apple hardware. Federal agencies and enterprise administrators must audit all systems running versions prior to these releases.
Technical Breakdown of CVE-2024-27834 and Pointer Authentication Bypasses
To evaluate the impact of CVE-2024-27834, engineers must understand the architectural role of Pointer Authentication (PAC) on modern ARM hardware. Introduced in the ARMv8.3-A architecture and embedded across Apple Silicon chips (A12 and newer mobile SOCs, M1 and newer desktop chips), PAC serves as a hardware-assisted defense against Control-Flow Hijacking attacks, such as Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP).
In standard 64-bit virtual memory architectures, high-order bits of virtual memory addresses remain unused. PAC leverages these unused bits to embed a cryptographic signature—a Pointer Authentication Code—generated via a hardware cryptographic extension using specified secret keys, the pointer address, and a context modifier. Before a pointer is executed or dereferenced, the processor verifies the embedded signature using instructions like autia or autib. If memory corruption alters the pointer address, signature verification fails, forcing a kernel panic or process termination.
# Conceptual layout of a 64-bit Pointer Authentication Code (PAC) signed pointer
+-----------------------+----------------------------------+
| PAC Signature (Bits) | Virtual Memory Address (Bits) |
+-----------------------+----------------------------------+
|||
CVE-2024-27834 originates from an improper authentication design within platform libraries handling pointer verification routines. When an attacker achieves an initial memory write primitive—such as corrupting a JavaScript object structure inside WebKit—PAC normally prevents them from writing arbitrary return addresses or forging function pointers, because the attacker lacks access to the hardware PAC signing keys.
However, CVE-2024-27834 allows an attacker with arbitrary read and write capabilities to bypass PAC checks without knowing the signing key. The flaw allows corrupted or forged pointers to pass verification routines successfully, effectively rendering hardware-assisted Control-Flow Integrity (CFI) ineffective.
Hardware Protection Integrity Notice
Neither Apple nor public security advisories have disclosed the specific low-level silicon register routines or assembly instructions implicated in the PAC authentication logic failure. System administrators should note that PAC bypasses do not grant direct root privileges on their own; rather, they eliminate the hardware safety net that prevents browser memory corruption from executing native shellcode.
By bypassing PAC, the exploit chain converts a restricted, sandboxed memory corruption condition into arbitrary native code execution. In Apple’s May 2024 update, engineers corrected the authentication flaw by implementing strict, redundant validation logic during pointer checking operations across iOS 17.5 and macOS Sonoma 14.5.
Anatomy of the APT29 Zero-Click WebKit Exploit Chain
Threat research from Sekoia attributes the observed exploitation campaign to APT29, a sophisticated state-sponsored threat group linked to the Russian SVR. The campaign utilizes a zero-click, multi-stage exploit chain capable of executing payloads simply by rendering a compromised web page, requiring zero interactive prompts from the end user.
The technical progression relies on two distinct exploit primitives acting in sequence:
- Initial Memory Corruption (WebKit RCE – CVE-2025-43529): The attack begins when the browser engine parses malicious JavaScript served from a compromised web source. CVE-2025-43529, a remote code execution vulnerability in WebKit, triggers a memory corruption condition inside the rendering engine’s heap memory. This provides the attacker with initial arbitrary memory read and write capabilities inside the web renderer process.
- Exploit Handoff and Mitigation Bypass (PAC Bypass – CVE-2024-27834): Operating within the WebKit process memory space, the exploit encounters hardware PAC enforcement preventing arbitrary code execution. The attacker invokes CVE-2024-27834 to circumvent pointer verification checks. This step neutralises PAC validation, allowing execution to flow to attacker-controlled instructions.
- Payload Execution: With PAC defeated, the exploit chain executes an in-memory native loader that fetches and runs the secondary infostealer script directly inside the targeted user’s security context.
+-----------------------------------------------------------------------------------+
| APT29 Zero-Click Attack Flow |
+-----------------------------------------------------------------------------------+
| 1. Web Browsing / Plerdy SEO Tracker Script Loaded |
| │ |
| ▼ |
| 2. WebKit Renderer Memory Corruption (CVE-2025-43529) |
| │ Enables Arbitrary Memory Read/Write |
| ▼ |
| 3. Pointer Authentication Bypass (CVE-2024-27834) |
| │ Disables PAC Control-Flow Integrity Checks |
| ▼ |
| 4. Unauthenticated Control Escalation & Infostealer Execution |
| │ Extracts Browser Cookies, Session Tokens, and System Identifiers |
+-----------------------------------------------------------------------------------+
Because the exploit sequence executes entirely in memory within the browser process context, traditional disk-based antivirus solutions often fail to generate behavioral alerts during the initial compromised execution phase.
Three Initial Access Vectors: Compromised Sites, Spoofs, and Supply Chain
APT29 constructed three primary initial delivery pathways to maximise target reach across geographical and industry verticals. Rather than relying on traditional spear-phishing attachments, the threat actor targeted web infrastructure directly.
1. Compromised Legitimate Websites
APT29 compromised vulnerable legitimate third-party web servers, injecting obfuscated JavaScript tags directly into legitimate HTML templates. Users visiting these compromised sites inadvertently executed the exploit loader during standard page rendering.
2. Spoofed Sites Masquerading as Popular Portals
The threat actor deployed lookalike domains mimicking news platforms, institutional portals, and corporate login services. These domains served duplicate site layouts containing the malicious exploit loader scripts, drawing in targets via targeted redirection and link sharing.
3. Supply Chain Compromise of Plerdy SEO Tracker
The most expansive vector identified in Sekoia’s research was a supply chain intrusion targeting Plerdy SEO Tracker, a popular web analytics and conversion tracking provider. APT29 modified the provider’s hosted JavaScript library. Websites incorporating the tracking script unknowingly loaded the malicious payload directly onto their visitors’ devices.
Supply Chain Intrusion Details
The specific technical entry point utilized by APT29 to breach Plerdy’s backend script distribution infrastructure has not been publicly disclosed. However, the vector highlights how third-party web analytics tags bypass traditional perimeter controls, executing with full client-side script authority.
Device Profiling Stage
Before launching the memory corruption exploits, the injected JavaScript executes a device profiling routine. The script checks environment properties, including user-agent strings, device hardware architecture, screen capabilities, and installed browser extensions.
# Conceptual representation of device profiling checks performed by script
- User-Agent String Inspection (verifying Safari/Chrome on iOS/macOS)
- Platform & Architecture Audit (checking for ARM64 / Apple Silicon platform)
- OS Build Number Correlation (filtering out patched OS versions)
- Execution Decision: If vulnerable target confirmed -> serve CVE-2025-43529 / CVE-2024-27834
If the profiling script identifies a target matching unpatched Apple operating system signatures, it requests the full binary exploit chain. If the device is patched, modern, or running an unsupported platform, the script aborts, protecting the exploit chain from discovery by automated web crawlers and security sandboxes.
Payload Mechanics and Cookie Theft Execution
Following successful execution of the exploit chain, APT29 deploys an information-stealing payload tailored for credential and session extraction. Rather than attempting destructive activities or deploying ransomware, the state-sponsored actors focused on persistent identity access.
The post-exploitation payload targets specific data repositories stored within browser profiles:
- Browser Session Cookies: Direct extraction of active HTTP cookies, including session identifiers for enterprise identity providers, webmail services, and cloud management consoles.
- Local Storage and Web Database Entries: Accessing HTML5 LocalStorage and IndexedDB stores containing application state tokens and OAuth session keys.
- System Identifiers and Telemetry: Gathering serial numbers, hostnames, system hardware UUIDs, and network environment configurations to map target enterprise networks.
The theft of session cookies severely degrades enterprise identity security. Modern Single Sign-On (SSO) frameworks rely on encrypted session cookies to maintain user identity across multi-tenant SaaS environments following initial Multi-Factor Authentication (MFA). When APT29 extracts these session cookies, the attackers import them into remote browser instances, effectively hijacking active user sessions.
This bypasses primary password checks, TOTP prompts, push notifications, and FIDO2/WebAuthn hardware key checks. Because the hijacked session appears as an already-authenticated session to cloud identity services, threat actors gain unrestricted lateral access to corporate environments without triggering standard brute-force or MFA fatigue alerts.
Enterprise Fleet Risk and Legacy OS Patching Gaps
Exploitation of CVE-2024-27834 highlights a recurring operational vulnerability in enterprise systems: the patch gap between OS vendor release dates and corporate fleet patch deployment. More than two years after Apple published fixes in May 2024, corporate endpoints remain vulnerable for several structural reasons.
In Bring Your Own Device (BYOD) and hybrid work models, mobile devices running iOS often delay operating system updates. End users frequently postpone major OS updates to avoid workflow interruptions or storage usage. Unless enforced by strict Mobile Device Management (MDM) compliance policies, mobile endpoints can remain vulnerable for months.
Enterprise fleets also suffer from legacy platform lock-in. Certain specialized operational applications require legacy operating system builds, preventing administrators from upgrading devices to macOS Sonoma 14.5 or iOS 17.5. Legacy devices capped at older major releases (such as iOS 16 builds prior to 16.7.8) remain fully exposed to this WebKit and PAC bypass chain.
Furthermore, third-party analytics and tracking scripts, such as Plerdy, operate outside conventional software inventory controls. Security teams routinely monitor installed native applications on endpoints but may overlook external JavaScript libraries executed inside employee browsers during daily web activity.
On iOS, this risk is amplified by browser engine dependencies. Historically, all iOS web browsers—including Chrome, Edge, and Firefox—were required to use the system WebKit engine. Consequently, WebKit vulnerabilities impact all iOS web browsing activity, regardless of the third-party browser application selected by the end user.
Remediation and Defensive Action Plan for Enterprise Security Teams
To defend enterprise endpoints against CVE-2024-27834 and associated exploit chains, security operations teams and platform administrators should execute a phased remediation strategy covering patch management, third-party script auditing, and identity governance.
1. Enforce Operating System Patch Baselines
Administrators must use MDM platforms (such as Jamf, Microsoft Intune, or Kandji) to enforce mandatory baseline updates across all corporate devices. Devices failing to meet these patch baselines must be restricted from accessing corporate SaaS and network resources.
Verify that endpoints meet or exceed the following target versions:
- iOS / iPadOS: Update to 16.7.8 (for legacy supported builds) or 17.5+ (recommended)
- macOS Sonoma: Update to 14.5+
- Safari: Update to 17.5+
Enterprise teams can run Osquery across macOS fleets to identify unpatched systems:
# Osquery command to identify macOS hosts running unpatched OS builds
SELECT hostname, os_version, build
FROM os_version
WHERE platform = 'darwin'
AND (
(build < '23F79' AND version LIKE '14.%') -- macOS Sonoma 14.5 build threshold
OR version LIKE '13.%' -- Legacy macOS Ventura
);
2. Restrict Third-Party Script Execution and Enforce CSP
Organizations managing internal and client-facing web applications must audit embedded third-party tracking scripts. Enforce strict Content Security Policy (CSP) headers to restrict where scripts can be fetched from and where DOM data can be transmitted.
# Example defensive HTTP Content Security Policy header
Content-Security-Policy: default-src 'self'; script-src 'self' https://trustedscripts.example.com; connect-src 'self' https://api.example.com; object-src 'none';
Implement Subresource Integrity (SRI) hashes for external scripts. SRI ensures that if a third-party analytics provider (such as Plerdy) is compromised and its JavaScript altered, the browser will reject execution due to a cryptographic hash mismatch.
<!-- Example of Subresource Integrity script element -->
<script src="https://analytics.example.com/tracker.js"
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNqlGYl1kPzQho1wx4JwY8wC"
crossorigin="anonymous"></script>
3. Mitigate Cookie Theft and Enforce Session Binding
Because the primary goal of the APT29 campaign is session cookie harvesting, identity architectures must enforce controls that limit the utility of stolen tokens:
- Enforce Short Session Lifespans: Re-authenticate high-privilege administrative sessions frequently to reduce the active lifespan of stolen cookies.
- Token and IP Binding: Configure identity providers to bind session tokens to originating client IP ranges or client TLS certificates. If a stolen cookie is presented from an unrecognized IP or device context, revoke the session immediately.
- Set Explicit Cookie Attributes: Ensure web applications issue cookies with the
SameSite=Strict,Secure, andHttpOnlyflags enabled to restrict cross-site script access.
Common Incident Response Mistake
When responding to suspected cookie harvesting attacks, resetting an employee’s password or requiring a new MFA prompt is often insufficient. Security teams must explicitly invoke the identity provider’s global token revocation API (e.g., Revoke-AzureADUserAllRefreshToken or Okta’s Clear User Sessions API) to terminate existing active session cookies instantly.
Key Takeaways for Enterprise Systems and Threat Defence
The active exploitation of CVE-2024-27834 by APT29 illustrates the evolving strategy of state-sponsored threat actors. Rather than relying solely on zero-day vulnerabilities, sophisticated groups systematically target legacy unpatched devices using N-day vulnerabilities, combining them with novel supply chain delivery mechanisms.
Hardware mitigations like ARM Pointer Authentication (PAC) represent essential security controls, but they are not infallible. When architectural implementation flaws allow PAC bypasses, memory safety protections inside browser engines crumble. Enterprise security strategies cannot rely exclusively on underlying platform hardware protections to prevent compromise.
Third-party web analytics tags, SEO trackers, and embedded external scripts must be treated as untrusted attack surfaces. Organizations must combine aggressive operating system patch management with web application security controls—such as Content Security Policy and Subresource Integrity—to mitigate supply chain risks.
Finally, security teams operating within or supplying Federal Civilian Executive Branch agencies must ensure full compliance with CISA’s KEV directive by applying Apple’s patches before the 18 November 2026 deadline. Commercial enterprises should adopt the same timeframe to secure their endpoints against active espionage campaigns.
Frequently asked questions
What is the severity and impact of CVE-2024-27834?
CVE-2024-27834 carries a CVSS score of 5.5 and is classified as an improper authentication issue. Its impact is significant when chained with a memory corruption flaw, as it allows attackers with arbitrary read and write capabilities to bypass Pointer Authentication (PAC), resulting in unauthenticated control-flow hijacking and arbitrary code execution.
Which Apple operating systems and versions address CVE-2024-27834?
Apple remediated the flaw in May 2024. Systems running iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5 or later are protected against this vulnerability.
How does APT29 deliver the exploit chain to target devices?
APT29 uses three primary vectors: compromising legitimate websites, deploying spoofed portals, and compromising the Plerdy SEO Tracker supply chain. Malicious JavaScript profiles the visitor’s device platform before serving a zero-click exploit chain combining WebKit flaw CVE-2025-43529 and PAC bypass CVE-2024-27834 to deliver an information-stealing payload.
Why is bypassing Pointer Authentication (PAC) significant for attackers?
PAC uses cryptographic signatures in unused pointer bits to enforce hardware-level Control-Flow Integrity. Bypassing PAC allows attackers to overwrite pointer addresses without triggering processor-level validation panics, enabling them to turn constrained browser memory corruption into unrestricted native code execution.
What action does CISA mandate for Federal Civilian Executive Branch agencies?
CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on 5 November 2026. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must apply vendor updates across all affected systems by 18 November 2026.
Sources and further reading
This article was drafted with AI assistance from the publicly cited sources and passed automated checks for structure and sourcing. Verify critical details against the vendor advisories linked above before acting.