Apple has released an important security update to fix a newly discovered zero-day vulnerability that has reportedly been exploited in “extremely sophisticated” cyberattacks. The flaw, identified as CVE-2025-24201, affects the WebKit browser engine and could allow attackers to execute arbitrary code by crafting malicious web content.
CVE-2025-24201 in Detail
The vulnerability is described as an out-of-bounds write issue, which means an attacker could leverage this flaw to break out of the Web Content sandbox in Apple’s devices. This type of security breach allows malicious web content to execute unauthorized actions, potentially compromising user data and system integrity.
Apple confirmed that it has resolved the issue with improved security checks, making sure that unauthorized actions can no longer occur. This fix is also noted as a supplementary patch for an attack that was originally mitigated in iOS 17.2.
Active Exploitation in Sophisticated Targeted Attacks
One of the most concerning aspects of this vulnerability is that Apple acknowledged its active exploitation in highly sophisticated attacks targeting specific individuals. However, the company has not disclosed details regarding the origins of the attack, the affected user base, or the duration of exploitation. It also remains unclear whether the vulnerability was discovered internally by Apple’s security team or reported by an external researcher.
Affected Devices and Software Versions
Apple has rolled out patches for a wide range of devices and software versions. The affected and patched systems include:
- iOS 18.3.2 & iPadOS 18.3.2
- iPhone XS and later
- iPad Pro 13-inch, iPad Pro 12.9-inch (3rd generation and later)
- iPad Pro 11-inch (1st generation and later)
- iPad Air (3rd generation and later)
- iPad (7th generation and later)
- iPad mini (5th generation and later)
- macOS Sequoia 15.3.2
- Macs running macOS Sequoia
- Safari 18.3.1
- Macs running macOS Ventura and macOS Sonoma
- visionOS 2.3.2
- Apple Vision Pro
Apple’s Track Record in 2025 Zero-Day Fixes
With this latest security update, Apple has now patched a total of three actively exploited zero-day vulnerabilities in 2025 alone. The two other vulnerabilities — CVE-2025-24085 and CVE-2025-24200 — were also addressed in previous security updates.
These repeated zero-day fixes highlight the growing sophistication of cyber threats targeting Apple’s ecosystem, reinforcing the need for users to stay up to date with security patches.
What Should Users Do?
Apple users are strongly advised to update their devices immediately to ensure they are protected from potential exploits. To update:
iPhone & iPad: Go to Settings > General > Software Update, then install the latest iOS/iPadOS update.
Mac: Open System Settings > General > Software Update and apply the macOS update.
Safari: Mac users on Ventura or Sonoma should update Safari through System Settings > Software Update.
Apple Vision Pro: Update visionOS through Settings > General > Software Update.
Apple’s latest security update demonstrates the ongoing challenges against sophisticated zero-day exploits. While Apple has responded swiftly to mitigate the threat, the lack of transparency regarding the attackers and the scale of the impact has raised concerns.
Milena Dimitrova
An inspired writer and content manager who has been with SensorsTechForum since the project started. A professional with 10+ years of experience in creating engaging content. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim
Follow Me: