This vulnerability involves an inconsistent user interface state management flaw in Apple iOS and iPadOS that may allow a malicious app to access sensitive user data without proper authorization. The issue is tracked as CWE-451 (Incorrect Expression of User Intent). Apple fixed the problem in version 26.5 of iOS, iPadOS, and visionOS. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, no privileges required, no user interaction needed, and impact on confidentiality only.

An attacker could exploit this vulnerability to gain unauthorized access to sensitive user data on affected Apple devices. The confidentiality of user data is impacted, but integrity and availability are not affected. No known exploits have been reported in the wild.

A fix is available from Apple in iOS 26.5, iPadOS 26.5, and visionOS 26.5. Users and administrators should update affected devices to these versions or later to remediate the vulnerability. No other mitigation guidance is provided or necessary as the issue is addressed by the official patch.