Product:
iOS and iPadOS
Summary
This issue was addressed with additional entitlement checks. An app may be able to circumvent App Privacy Report logging. The issue is fixed in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28873 |
Exploitation
To exploit this vulnerability, an attacker could create a malicious app that circumvents the App Privacy Report logging. By leveraging the entitlement checks that were not properly enforced, the app could potentially access sensitive user data without proper logging, leading to privacy violations.
Affected Products
- iOS 18.7.9 – Fixed with additional entitlement checks to prevent circumvention of App Privacy Report logging.
- iPadOS 18.7.9 – Addressed similar issues as iOS with the same fixes.
- iOS 26.4 – Includes the necessary updates to enhance privacy protections.
- iPadOS 26.4 – Similar updates as iOS to ensure user data is protected.
Mitigation
Users are advised to update their devices to the latest versions of iOS and iPadOS to mitigate this vulnerability. The updates include important security enhancements that address the entitlement checks and prevent unauthorized access to user data.