Apple fixes zero-day bug in Apple Vision Pro that ‘may have been exploited’

Apple released visionOS 1.0.2 to fix a WebKit vulnerability (CVE-2024-23222) that could permit remote code execution and that Apple says "may have been exploited" in the wild; the same flaw was patched across iPhone, iPad, Mac and Apple TV, though Apple Watch was not patched. The report provides no firm evidence about attackers or the scale of exploitation, and urges updating affected devices.