Shattering the Glass Cage: Dissecting the CVE-2025-24201 WebKit Escape
Vulnerability ID: CVE-2025-24201
CVSS Score: 10.0
Published: 2025-03-11
CVE-2025-24201 is a critical Out-of-Bounds Write vulnerability within Apple's WebKit engine that serves as the linchpin for the 'Glass Cage' zero-click exploit chain. By processing maliciously crafted web content, an attacker can trigger memory corruption to escape the Web Content sandbox. This vulnerability was actively exploited in the wild to target high-risk individuals, allowing attackers to pivot from an initial entry in ImageIO to full kernel compromise via a subsequent Core Media exploit.
TL;DR
A critical OOB Write in WebKit allows for a sandbox escape. It is the second stage of the 'Glass Cage' zero-click chain targeting iOS/macOS. Exploitation requires no user interaction (zero-click) via iMessage. Apple has patched this in iOS 18.3.2 and related updates.
⚠️ Exploit Status: ACTIVE
Technical Details
- CWE ID: CWE-787 (Out-of-Bounds Write)
- Attack Vector: Network (Zero-Click)
- CVSS v3.1: 10.0 (Critical)
- EPSS Score: 0.08% (Highly Targeted)
- Exploit Status: Active (CISA KEV)
- Impact: Sandbox Escape / RCE
Affected Systems
- iOS
- iPadOS
- macOS
- watchOS
- visionOS
- Safari
-
iOS / iPadOS: < 18.3.2 (Fixed in:
18.3.2) -
macOS Sequoia: < 15.3.2 (Fixed in:
15.3.2) -
watchOS: < 11.4 (Fixed in:
11.4)
Exploit Details
- CISA: Known Exploited Vulnerability in the wild.
Mitigation Strategies
- Enable Apple Lockdown Mode
- Disable iMessage Previews (reduces attack surface)
- Implement MDM restrictions for OS version compliance
Remediation Steps:
- Update iOS/iPadOS to version 18.3.2 or later
- Update macOS Sequoia to 15.3.2 or later
- Update watchOS to 11.4
- Update visionOS to 2.3.2
References
Read the full report for CVE-2025-24201 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)