While Apple users have been busy showing off their sleek devices, hackers have been quietly making themselves at home. The tech giant is scrambling to address yet another zero-day vulnerability, this time identified as CVE-2025-24201, affecting the widely-used WebKit browser engine. It’s the third zero-day of 2025. Not a great look for a company that charges premium prices for supposedly premium security.
Apple’s security mystique crumbles as hackers exploit their third zero-day of 2025, making premium price tags harder to justify.
This isn’t your average bug. Apple itself called it an “extremely sophisticated attack” targeting specific individuals. The vulnerability allows malicious web content to break out of the sandbox protection and potentially execute code remotely. Translation: hackers can take over your shiny device while you’re just browsing the web. No clicking required.
The impact spans across Apple’s ecosystem. iPhones (XS and newer), various iPad models, Macs running macOS Sequoia, and even the Vision Pro headset are all vulnerable. Safari browser users on macOS Ventura and Sonoma aren’t safe either. The company’s entire product line is fundamentally compromised.
Apple has released emergency security updates including iOS 18.3.2, iPadOS 18.3.2, macOS Sequoia 15.3.2, visionOS 2.3.2, and Safari 18.3.1. Users should update immediately. But let’s be real – many won’t until their device forces them to. This lack of immediate action highlights why basic cybersecurity knowledge is crucial for all users, not just IT professionals.
The vulnerability allows attackers to break out of WebKit’s sandbox protection, potentially leading to unauthorized actions, data theft, and complete device compromise. The out-of-bounds write issue enables unauthorized actions that could compromise user data. Privacy? Security? Those selling points are looking pretty flimsy right now.
This latest crisis follows a concerning pattern. Two other zero-days were already patched in January and February this year. This is similar to the use-after-free vulnerability that plagued Apple’s Core Media framework earlier this year. While 2024 saw only six zero-days (down from twenty in 2023), the increasing sophistication of these attacks suggests hackers are getting better at finding ways into Apple’s walled garden.
Maybe it’s time for Apple fans to be a little less smug about security. Just saying.
