CVE-2024-23222: Type confusion in Safari, iOS and macOS – urgent patch

CVE-2024-23222 is a type confusion vulnerability in Apple's Safari, iOS, iPadOS, macOS, tvOS and visionOS. When a user visits a malicious webpage, the browser may confuse the type of an object in memory, allowing an attacker to execute arbitrary code on the device. The vulnerability was fixed on January 22, 2024 in iOS 17.3 and later patched for earlier versions. While exploitation requires the user to visit a compromised site, the impact—arbitrary code execution—is severe and potentially undetectable without proper forensics.

The CVSS score of 8.8 classifies the risk as 'high'. Two years after the initial fix release (January 2024), the threat remains significant: many organizations have not fully updated their iOS 15 and 16 devices. As of November 2026, public repositories on GitHub declare containing reproduction material for the Coruna exploit: a signal that the vulnerability remains on researchers' radar. Confirmation of ongoing risk: the number of exposed devices remains substantial.

Systems administrators and CISOs must urgently verify patch status across these scenarios: (1) Device inventory – which iOS, iPadOS and macOS versions are in use? (2) Update priority: iOS 17.3+, macOS Monterey 12.7.3+, Sonoma 14.3+, Ventura 13.6.4+. (3) For legacy devices (iOS 15, 16): confirm receipt of backported patches (15.8.7 or 16.7.5). (4) Monitoring: enable alerts for non-compliant devices and track update completion. Maintaining unpatched device versions on corporate networks without compensative mitigations is not advised.