Product:
iOS
Summary
This issue was addressed through improved state management. The problem allows Private Browsing tabs to be accessed without authentication. It is fixed in iOS 26 and iPadOS 26. Users should update to the latest version to ensure their privacy.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-30468 |
Exploitation
An attacker can exploit this vulnerability by accessing a device that has Private Browsing tabs open. Since no authentication is required, the attacker can view the contents of these tabs without any user interaction. This can lead to unauthorized access to sensitive information that the user believed was private.
Affected Products
- iOS: Vulnerable versions prior to iOS 26 allow unauthorized access to Private Browsing tabs.
- iPadOS: Vulnerable versions prior to iPadOS 26 also allow unauthorized access to Private Browsing tabs.
Mitigation
To mitigate this issue, users should update their devices to iOS 26 or iPadOS 26. This update includes fixes that improve state management and prevent unauthorized access to Private Browsing tabs. Regularly updating devices is essential for maintaining security.