Product:
iOS, iPadOS, macOS, visionOS
Summary
This issue was addressed through improved state management. An attacker may be able to track users through their IP address. The issue is fixed in multiple versions of iOS, iPadOS, macOS, and visionOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28906 |
Exploitation
To exploit this vulnerability, an attacker would need to leverage the ability to track users through their IP address. This could involve sending crafted network requests that allow the attacker to gather information about the user’s location and potentially their identity.
Affected Products
- iOS 18.7.9 and earlier: Vulnerable to user tracking through IP address.
- iPadOS 18.7.9 and earlier: Vulnerable to user tracking through IP address.
- macOS Sequoia 15.7.7 and earlier: Vulnerable to user tracking through IP address.
- macOS Sonoma 14.8.7 and earlier: Vulnerable to user tracking through IP address.
- macOS Tahoe 26.5 and earlier: Vulnerable to user tracking through IP address.
- visionOS 26.5 and earlier: Vulnerable to user tracking through IP address.
Mitigation
To mitigate this issue, users should update their devices to the latest versions of iOS, iPadOS, macOS, and visionOS as specified in the security updates. Regularly applying updates can help protect against vulnerabilities and enhance overall security.