Product:
iOS
Summary
A logic issue was addressed with improved restrictions. A malicious app may be able to break out of its sandbox. This issue is fixed in multiple versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2026-28995 |
Exploitation
To exploit this vulnerability, an attacker would need to create a malicious application that can bypass the sandbox restrictions imposed by the operating system. Once the app is installed on a vulnerable device, it could potentially access sensitive data or perform unauthorized actions, leading to a compromise of the device’s security.
Affected Products
- iOS 18.7.9 and earlier: Vulnerable to sandbox escape issues.
- iPadOS 18.7.9 and earlier: Similar vulnerabilities as iOS.
- macOS Tahoe 26.5 and earlier: Affected by the same logic issue.
- tvOS 26.5 and earlier: Vulnerable to the same sandbox escape.
- visionOS 26.5 and earlier: Affected by the logic issue.
- watchOS 26.5 and earlier: Vulnerable to the same issue.
Mitigation
To mitigate this vulnerability, users should update their devices to the latest versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Regularly updating software helps ensure that security patches are applied, reducing the risk of exploitation.