APT29 Apple Safari Chrome Attack Uses Patched Flaw, CISA Says

Russia-linked hackers have been using Apple and Chrome flaws that were patched long before the attacks surfaced. On Wednesday, the U.S. government put one of them on its list of exploited vulnerabilities. The APT29 Apple Safari Chrome attack, as researchers at Sekoia describe it, pushes data-stealing malware through websites that visitors already trust.

The Cybersecurity and Infrastructure Security Agency added Apple's CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, 2026. Federal civilian agencies now have until November 18 to patch it. For everyone else, the listing signals that the flaw is being used in real attacks and that the fix Apple shipped in May 2024 is the one that counts.

The listing follows a Sekoia report published November 4 and 5 that names a nation-state actor and says the campaign targets iPhone, Mac and Android users. The story is less than 72 hours old and still has more open questions than settled answers. Here is what is confirmed, what to install and what remains unknown.

What CISA added and why the deadline matters

CVE-2024-27834 is a pointer-authentication bypass affecting several Apple operating systems. Rescana lists its CVSS score as 5.5, which places it in the medium range, and classifies it as improper authentication under CWE-287. A medium score does not decide whether a flaw matters. Catalog inclusion depends on evidence of exploitation, which makes the KEV entry the more meaningful signal.

Apple first fixed the bug in May 2024. According to The Hacker News, it had also been demonstrated as a zero-day at the Pwn2Own Vancouver contest that March. That history leads to two conclusions. Anyone running a build from Apple's May 2024 fix or later is covered, and the attackers are reusing bugs that were already public rather than finding new ones.

CISA also added a WordPress core flaw on November 3 under BOD 26-04, according to the agency's alert. That is a separate story, though the same directive governs both listings. Our WordPress update guide covers that fix.

How the APT29 Apple Safari Chrome attack works

Sekoia attributes the activity to APT29, which is also tracked as Cozy Bear and Midnight Blizzard and is affiliated with Russia's Foreign Intelligence Service. The firm assessed its confidence as "moderate to high," a phrase that signals a reasoned judgment rather than proof. Attribution in threat reporting is an assessment, so readers should treat the label as Sekoia's call.

Sekoia describes three delivery routes:

• Compromised legitimate websites that carried the malicious code.
• Lookalike domains that proxied real sites, so visitors saw pages that looked normal.
• A supply-chain compromise of Plerdy SEO Tracker, a Ukrainian web analytics script that websites embed to measure visitors.

Sekoia says it found the campaign in mid-October 2026. The poisoned analytics script was reportedly live only from August 27 to September 3, according to a DEV Community summary of the findings. A window that short suggests the operators used the script briefly, but Sekoia has not said whether it aimed at particular visitors or collected data broadly.

The researchers also argued that the tooling itself lowers the bar. "The adoption of packaged N-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation," the researchers wrote, as quoted by DEV Community. An N-day exploit targets a flaw that is already patched, which means the defense already exists in the form of an update. The campaign also reuses exploit frameworks built by commercial surveillance vendors.

The practical lesson is that patch speed matters more than the novelty of the bug. A state actor does not need a fresh zero-day when repurposed code can use a flaw that stays unpatched on some devices. The attacker who can reuse someone else's exploit gains the most, and the user who delays an update loses the most.

Which Apple devices and versions are affected

Apple's May 2024 fixes improved checks in the affected components. Sekoia reports that Apple has patched the flaws used in this campaign, and the first fixed builds are listed below. Current software includes every fix, so the real question is whether your device still receives updates.

Sekoia says fully updated phones are not at risk. Users on iOS 16.7 should install 16.7.8 or newer. Devices that have stopped receiving Apple updates are the ones to worry about, because the fix only protects a device once it is installed.

Android chain: Chrome 139 to 145 and Qualcomm

For Android, Sekoia describes a chain that combines CVE-2026-3910, a Chrome flaw patched in March 2026, with CVE-2025-27038, a Qualcomm flaw fixed in Android's August 2025 update, according to AndroidPure. The affected Chrome range is versions 139 through 145, excluding 143. Sekoia reports that Apple and Google have patched the flaws used.

The Android payload, called AndroSnitch, targets Chrome cookies, passwords, browsing history and saved Wi-Fi passwords. The Wi-Fi detail deserves attention. A stolen Wi-Fi password can expose the home or office network a phone joins, which reaches well beyond a single account. Android users with outdated Chrome or unpatched Qualcomm components are the exposed group.

What to update now

Each of these steps takes only a few minutes.

1. On an iPhone or iPad, open Settings, tap General, then Software Update, and install the latest iOS or iPadOS. If the device is stuck on iOS 16, install 16.7.8 or newer.
2. On a Mac, open System Settings, choose General, then Software Update. Macs running Sonoma should be on 14.5 or later.
3. Safari ships with macOS, so updating the operating system updates the browser. Confirm you are on Safari 17.5 or later, the earliest fixed build.
4. On Android, check for system and security updates in Settings. Confirm Chrome is current through the Play Store, and update now if your version falls between 139 and 145.
5. If you used an affected browser on a site you do not trust, change your saved passwords after updating. If a compromised phone may have saved your Wi-Fi password, change that as well.

What remains unknown

• The CVE picture is inconsistent. One report cites CVE-2025-43529 alongside CVE-2024-27834 in the iOS chain, and an analysis from Mallory flags an inconsistent identifier in the exploit-chain description. The precise role of CVE-2024-27834 is unclear.
• Scale is unknown. Sekoia has not published a count of infected users.
• Targeting is unknown. Sekoia has not said whether the operators chose specific visitors or collected broadly.
• The U.S. claim rests on secondary coverage. A CloudLink Tech report says the campaign targeted iOS and Android users in Europe and the United States. We could not check that against Sekoia's original report.
• No U.S. organization has publicly confirmed a compromise in the reporting reviewed for this story.

What comes next

Watch three things. The November 18 federal deadline will show how quickly agencies act on a flaw patched in May 2024. Sekoia's indicators and any victim count would settle the CVE discrepancy and show how far the campaign reached. The Android chain could draw its own catalog listing if the evidence supports one, though nothing in the reporting reviewed says that has happened.

Exploitation of old, patched flaws is not limited to state actors. Ransomware gangs have been using a Palo Alto GlobalProtect flaw too, as our coverage of that campaign shows. The pattern repeats: a fix exists, and attackers count on it going unapplied. For most readers, the most useful step this week is a five-minute check of the update screen on every phone, tablet and laptop at home.