Product:
macOS and iOS
Summary
The issue was addressed with additional restrictions on the observability of app states. A sandboxed app may be able to access sensitive user data. This issue is fixed in multiple versions of macOS and iOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-20680 |
Exploitation
An attacker with local access to a vulnerable device could exploit this issue by running a malicious app that takes advantage of the insufficient restrictions on app state observability. This could allow the app to access sensitive user data without proper authorization.
Affected Products
- macOS Tahoe
- macOS Sonoma
- macOS Sequoia
- iOS
- iPadOS
Mitigation
Users are advised to update their devices to the latest versions of macOS and iOS to mitigate this vulnerability. Regularly applying security updates can help protect against potential exploits.