Apple Drops Another WebKit Zero-Day Bug

Apple released emergency fixes for CVE-2025-24201, an out-of-bounds write in the WebKit engine used by Safari and other apps across iOS, iPadOS, macOS, and visionOS; the flaw enables sandbox escape and could lead to arbitrary code execution and full device compromise. Apple says the bug has been exploited in an "extremely sophisticated" targeted attack, prompting updates and mitigation guidance while researchers note exploitation requires advanced skills and is likely part of targeted, high-resource operations.