CVE-2024-40867: Apple iPadOS

Critical severity, CVSS 9.6. EPSS: 0.7% chance of exploitation in the next 30 days.

A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox.

Affected products

• Apple iPadOS: before 18.1 (fixed in 18.1)
• Apple iPhone OS: before 18.1 (fixed in 18.1)

Published 2024-10-28. Last modified 2026-06-17.