Product:
iOS, iPadOS, macOS, visionOS
Summary
This issue was addressed by adding an additional prompt for user consent. An app may be able to access user-sensitive data. The issue is fixed in multiple versions of iOS, iPadOS, macOS, and visionOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-28993 |
Exploitation
To exploit this vulnerability, an attacker would need to have local access to the device. By leveraging the flaw, the attacker could potentially access sensitive user data without proper consent, as the application may bypass necessary permissions.
Affected Products
- iOS 18.7.9 and earlier: Vulnerable to unauthorized access to user-sensitive data.
- iPadOS 18.7.9 and earlier: Similar vulnerabilities as iOS, allowing data access without consent.
- macOS Sequoia 15.7.7 and earlier: Affected by the same issue, enabling potential data breaches.
- macOS Sonoma 14.8.7 and earlier: Vulnerable to unauthorized data access.
- macOS Tahoe 26.5 and earlier: Similar risks as other macOS versions.
- visionOS 26.5 and earlier: Vulnerable to unauthorized access to sensitive data.
Mitigation
To mitigate this vulnerability, users should ensure their devices are updated to the latest versions of iOS, iPadOS, macOS, and visionOS. Regularly updating software can help protect against potential exploits and unauthorized access to sensitive data.