Apple has released emergency security updates to address a newly discovered zero-day vulnerability found in the WebKit engine used by Safari and other applications. Described as an out-of-bounds write issue, the flaw, tracked as CVE-2025-24201, allows attackers to craft malicious web content capable of escaping the Web Content sandbox, potentially allowing attackers to conduct unauthorized actions. Apple acknowledged that the vulnerability has been exploited in “extremely sophisticated” attacks against specific targeted individuals on versions of iOS before 17.2. The company implemented improved security checks to mitigate the issue, labeling this update as a supplementary fix for an attack previously blocked in iOS 17.2. Affected devices include iPhone XS and later, multiple iPad models, Macs running macOS Sequoia, Apple Vision Pro, and Macs running Safari 18.3.1 on macOS Ventura and Sonoma. While Apple has not disclosed specific details regarding the attacks, such as their origin, duration, or affected individuals, users are strongly advised to install the updates immediately. This marks the third actively exploited zero-day Apple has patched in 2024, following CVE-2025-24085 and CVE-2025-24200, continuing the company’s ongoing efforts to address critical security vulnerabilities. CTIX analysts recommend that Apple users ensure that they have automatic updates turned on and regularly check to ensure that they are running the most recent patch to prevent future exploitation.