Still on iOS 16? Hackers are using a 2024 Safari bug on old iPhones

On 4 November 2026 the US Cybersecurity and Infrastructure Security Agency added CVE-2024-27834, an Apple WebKit flaw, to its Known Exploited Vulnerabilities catalog. US federal agencies have until 18 November 2026 to patch it. CISA lists the affected product as Apple "Multiple Products".

The bug is from 2024. Apple fixed it on 13 May 2024 in iOS 17.5 and Safari 17.5, and in iOS 16.7.8 for the older iPhone 8, iPhone 8 Plus and iPhone X. It is back in the news because attackers are still using it against phones that never installed that update. The fix has existed for over two years. The phones being hit are the ones that stopped updating before May 2024.

Quick summary before the details:

• If your iPhone 8, 8 Plus or X runs iOS 16.7.8 or later, this specific attack chain does not work on it.
• If it stopped at iOS 16.7.7 or earlier, you are exposed and should update today.
• If you run an old version of Chrome on Android, a related attack applies to you too. Chrome 146 or later fixes it.

What did CISA add on 4 November, and why is a 2024 bug back?

The flaw itself sits in WebKit, the browser engine behind Safari and most iPhone browsers. It lets an attacker who already has read and write access to memory get past Pointer Authentication, an iPhone defence. Apple credits Manfred Paul working with Trend Micro's Zero Day Initiative. You can read Apple's original fix notes for iOS 17.5 and for iOS 16.7.8.

The campaign behind the CISA listing was documented by Sekoia, a French security company, in a report published the same day. We cover what it did in the next sections.

Which phones are at risk?

The attack chains documented by Sekoia split by device and software version. The iPhone chain built around CVE-2024-27834 only works on phones stuck at iOS 16.7.7 or earlier, because Apple fixed that flaw in iOS 16.7.8 back in May 2024. A second iPhone chain targets iOS 18.5, and a third targets Chrome on Android, specifically versions 139 to 145.

One caveat applies to the iPhone 8, 8 Plus and X. These phones get occasional fixes on iOS 16, not every fix. A fully updated iOS 16.7.16 phone breaks chain A, but it may still carry other WebKit bugs that newer iOS versions fixed. That limits what these phones should be used for, which we cover below.

How did a website visit turn into an attack?

The method is called a watering hole. Instead of sending targets a link or a message, attackers plant code on websites those targets are likely to visit. You browse to a site you trust, and the site serves the exploit.

Sekoia documented which sites were involved in this campaign. They were not news sites. The list included hacked legitimate pages: a Ukrainian gas production company, a US chemical-industry trade association, a Czech political party and a Bulgarian military-related site. There were also two lookalike domains, one imitating the US America250 anniversary site and one imitating a London luxury hotel. A hacked Ukrainian web analytics script, Plerdy, sat on thousands of mostly Ukrainian websites from 27 August to 3 September 2026. The countries affected were the US, Ukraine, the Czech Republic and Bulgaria, plus the UK through the hotel lookalike.

Two details matter most for anyone reading this on a phone:

• No tap was needed. Sekoia says the exploits were served without user interaction. Loading the page was enough.
• Nothing stayed on the phone after a restart. There was no persistence.

Sekoia links the campaign with moderate to high confidence to APT29, a group the company notes is widely linked to Russia's foreign intelligence service. Attribution aside, the practical lesson is the same one from our 2018 Safari and WebKit piece: a patched browser is the difference between a hostile page and a harmless one. Sekoia's own conclusion is that a user running an up-to-date operating system is safe from these attacks, since every flaw was fixed by the vendor before the campaign began.

Is an iPhone 8 or iPhone X safe once it is updated?

Mostly. Chain A needs two flaws working together. One of them, CVE-2024-27834, was fixed in iOS 16.7.8 on 13 May 2024, according to Apple's notes. So a phone on iOS 16.7.8 or later, including the current iOS 16.7.16, breaks that chain. The attack does not work on it.

The limit is the other flaw in the chain, CVE-2025-43529. Apple's notes list a fix for it in iOS 18 and iOS 26, but none for iOS 16. A fully updated iPhone 8 or X therefore blocks this campaign, yet it may still carry other WebKit bugs that newer iPhones no longer have. iOS 16 gets occasional fixes, not every fix, and the gap between it and current iOS grows over time.

What that means in practice:

• A phone on iOS 16.7.7 or earlier is exposed to chain A. Update to iOS 16.7.16 today, under Settings, then General, then Software Update.
• A phone on iOS 16.7.16 is safe from this campaign but should not be treated as fully patched. Keep it for calls, messages and browsing, and move banking and work accounts to a newer phone.
• A phone that no longer receives any updates at all should be retired. It will accumulate unpatched browser flaws.

The current iOS 16 release, 16.7.16, arrived on 11 May 2026, per Apple's release notes.

What about Android phones and Chrome?

The third chain targets Android, not iOS. It combines CVE-2026-3910, a flaw in Chrome, with CVE-2025-27038, a flaw in a Qualcomm graphics driver. Per Sekoia, it takes Chrome cookies, saved logins, browsing history and Wi-Fi settings.

The Chrome flaw was fixed on 12 March 2026 in Chrome 146 on desktop and on Android. Google said at the time that an exploit existed in the wild. That means the same rule applies here: the phones hit are the ones running Chrome 139 to 145, versions that stopped updating before March 2026.

Two separate updates matter on Android, and they do not arrive together:

• The browser: open the Play Store, search for Chrome and tap Update. You can check the installed version under Chrome's Settings, then About Chrome. You want 146 or later.
• The operating system: the Qualcomm driver flaw is fixed through Android system updates, under Settings, then System or Software update. An updated Chrome on an unpatched Android system still carries the second half of the chain.

Whether the driver fix reaches a given phone depends on its maker sending system updates. A phone that gets none should be retired, just like an old iPhone. The risk is concentrated on phones whose owners never install the updates they do get, which is exactly the pattern across all three chains in this campaign. If your Chrome has been sitting on version 145 or lower for months, treat that as a prompt to check for updates today.

What should you do today?

The fixes are ordinary updates, and every flaw in this campaign was patched by the vendor before the attacks started.

• On an iPhone, go to Settings, then General, then Software Update, and install whatever is offered. iPhone 8, 8 Plus and X owners should land on iOS 16.7.16 or later.
• On Android, open the Play Store, search for Chrome and tap Update. Check the result under Chrome's Settings, then About Chrome. You want version 146 or later.
• Install Android system updates separately, under Settings, then System or Software update. The browser update alone does not close the whole chain.
• If your phone no longer receives any updates at all, stop using it for banking, work accounts and shopping. Move those accounts to a device that does get patches.
• If you use an iPhone 8, 8 Plus or X for anything sensitive, start planning its replacement. Occasional fixes are not the same as full support.
• Sekoia found no persistence, so nothing stays on the phone after a restart, but cookies already taken stay taken; if an unpatched phone may have loaded one of these pages, sign out of all sessions on your important accounts and sign back in.

None of this is new advice. It is the same routine we described in our 2014 piece on an Apple SSL flaw: check for updates, install them, repeat. Our mobile security hub collects more of these basics in one place.

Can a VPN protect you from a browser exploit?

No. A VPN encrypts traffic between your device and the VPN server and hides your IP address from the sites you visit. It secures you on public Wi-Fi, which we cover in our public Wi-Fi piece. It does not patch Safari or Chrome, and it does not inspect the pages you load.

The exploits in this campaign arrived through the browser itself. If a hacked page serves an exploit, that exploit arrives inside the encrypted tunnel just like the rest of the page. The VPN sees a stream of encrypted traffic to one server; it has no way to tell a hostile page from a harmless one. Encryption protects the data in transit, not the code your browser runs after it arrives.

Where a VPN does help is the rest of your mobile use. On hotel, airport or cafe Wi-Fi, it keeps your traffic away from anyone else on that network. It is the one described in our public Wi-Fi article. It is a different problem from the one this campaign exploits.

The two layers do different jobs. Updates close the flaws that browser exploits rely on. A VPN protects your traffic on networks you do not control. A VPN is one layer, and updates are the other.