Product:
iOS, iPadOS, macOS, visionOS, watchOS
Summary
An authorization issue was addressed with improved state management. This issue allows an app to potentially access sensitive user data. The problem has been fixed in the latest versions of iOS, iPadOS, macOS Sequoia, macOS Tahoe, visionOS, and watchOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-28877 |
Exploitation
To exploit this vulnerability, an attacker would need to have local access to the device. By leveraging the authorization issue, the attacker could run a malicious application that may gain unauthorized access to sensitive user data. User interaction may be required in some scenarios, making it crucial for users to be cautious about the applications they install and run.
Affected Products
- iOS 26.4 – Latest version addressing the authorization issue.
- iPadOS 26.4 – Updated to fix the vulnerability.
- macOS Sequoia 15.7.5 – Includes the necessary security improvements.
- macOS Tahoe 26.4 – Contains the fix for the authorization issue.
- visionOS 26.4 – Updated to prevent unauthorized data access.
- watchOS 26.4 – Latest version with improved state management.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated to the latest versions of iOS, iPadOS, macOS, visionOS, and watchOS. Regularly checking for updates and applying them promptly can help protect against potential exploitation of this issue.