Caught in the WebKit: Getting Tangled with CVE-2025-24201

Shwena Kak & Candace Jensen

• April 4, 2025

Web browsers are the gateway to the internet, a ubiquitous fixture of every enterprise device—making them a critical point of exposure. When managing your fleet you may ask: Are we aware of the vulnerabilities affecting our users’ browsers? While vulnerability databases are a great place to start, the widespread use of common codebases makes it harder to trace and recognize vulnerabilities that affect multiple products.

CVE-2025-24201, a high-severity WebKit vulnerability targeting multiple AppleOS platforms, exemplifies this challenge. On 03/11/2025, Apple released iOS, macOS, and Safari patches. A few days later, Techscribe Central published a deep dive on how this vulnerability compromises several platforms and can provide a false sense of security.

In this article, we will show how this exploit extends far beyond the Apple ecosystem, and how Iru ensures customers are alerted to all vulnerable software with curated research.

CVE-2025-24201

This vulnerability has a high CVSS score of 8.8. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 17.2. Malicious groups often target WebKit for its widespread use across Apple’s ecosystem and third-party applications. CVE-2025-24201 is an out-of-bounds write vulnerability that improperly allocates data, causing memory corruption and potentially leading to remote code execution (RCE).

A threat actor could use this vulnerability to run arbitrary code and gain system control. It’s critical for users and organizations to apply security patches and mitigate their risk of exploitation.

Implications Beyond Webkit

Around the same time as Apple’s patch release, Google Chrome released a stable update of Chromium 134.0.6998.89 for macOS which had security fixes for CVE-2025-24201 and other vulnerabilities.

Apple Security Engineering and Architecture (SEAR) has historically shared CVEs with Google for Chromium updates before they are made publicly available. Back in 2013, Blink, part of Chromium’s engine, was forked from WebKit, and as a result, may still share some underlying attributes with WebKit. Blink and V8, Chromium’s JavaScript engine, form the core of the Chromium browser engine, handling rendering and script execution, respectively.

While CVE-2025-24201 primarily affects WebKit, shared components and dependencies between Chromium and WebKit could potentially expose third-party Chromium-based browsers to this exploit. However, due to Chromium’s security policy, connections between WebKit and Chromium’s fixes won’t be verifiable until 14 weeks after the initial release.

Considering vendor acknowledgments, CVE tracking, and Techscribe Central’s analysis of the potential impact, we can deduce the best course of action: ensure Chromium-based browsers (e.g., Microsoft Edge) are up-to-date.

Threat Intelligence Team Research

Research has shown that several Chromium-based browsers have updated to Chromium build 134.0.6998.89 for macOS following the disclosure of CVE-2025-24201.

Microsoft Edge released a security advisory on 03/12/2025 that specified the version users should upgrade to and acknowledged why this CVE affects Edge.
Vivaldi alerted customers on 03/10/2025 to update to the new version with a “Backported Upstream 134+ security patch for ‘Out of bounds write in GPU (CVE-2025-24201)’”.
Other browsers like Brave Browser and Arc Browser have also updated to the new Chromium build, but they did not explicitly reference the CVE.

Some browsers have not yet updated their Chromium version, which could leave users vulnerable to CVE-2025-24201.

We continue to explore potential connections between Blink and WebKit to enhance our Vulnerability Management product and better protect our customers.

Iru Vulnerability Management Impact

Iru Threat Intelligence has ensured our Vulnerability Management (VM) customers are on the most up-to-date, stable releases and can bypass this severe vulnerability.

According to NetMarketShare, approximately 75% of the global market uses Chromium-based browsers.

Caught in the WebKit

Since including this additional coverage, we have seen roughly 18% more unique device detections.

Conclusion

CVE-2025-24201 underscores how a single WebKit flaw can ripple across ecosystems far beyond Apple. With Iru's proactive research and vulnerability coverage, organizations can stay ahead of emerging threats across all affected platforms.

It’s recommended that admins and analysts monitor the usage of any third-party Chromium browsers, including the Chromium version.

Kandji is now Iru. This article was originally published under the Kandji brand.

Iru Quarterly Threat Report: August 2026

EDR threat detections and responses Iru EDR is built to detect threats before they go mainstream. By combining behavioral detections with insights from our own malware research, we're able to protect customers from exploitation even before public disclosures or patches become available.

Threat Intelligence August 11, 2026

Calvin So • 13 min read

Feature engineering for a macOS malware classifier, and why the Mac makes it harder than Windows

The threat landscape for macOS malware is expanding, while the number of specialists dedicated to defending against it has not kept pace. Unlike Windows, where machine learning (ML) models are supported by extensive documentation and standardized datasets, the macOS environment presents a significant knowledge gap. At Iru, we captured SSTAR Agent, a crypto drainer targeting web3 technology developers via a fake interview lure, which we documented in an earlier post using an ML triage we built.

Threat Intelligence August 5, 2026

Arek Dreyer • 8 min read

How-to guide: Changing and resetting Mac passwords

This post was originally published in May 2023 and has been updated in July 2026 to reflect the latest information. When was the last time you or someone in your organization needed their Mac password to be something different than what it previously was? There are two ways to do that: change or reset. But although those two words might seem similar, their difference is significant.

Educational July 29, 2026