Days After Google, Apple Reveals Exploited Zero-Day in Browser Engine

Apple disclosed and patched an actively exploited WebKit zero-day (CVE-2024-23222) — a type confusion bug enabling arbitrary code execution — and acknowledged possible in-the-wild exploitation; the article links this to past abuses by commercial spyware vendors and notes concurrent browser-zero-day activity and a sharp increase in evasive, browser-based phishing attacks.