This vulnerability in Apple iOS and iPadOS allows an app with limited privileges to access sensitive user data without explicit user consent. Apple mitigated the issue by introducing an additional prompt requiring user approval before access is granted. The flaw is tracked as CVE-2026-28993 with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating local attack vector with low complexity, requiring some privileges, no user interaction, unchanged scope, and high confidentiality impact. The vulnerability affects multiple Apple operating systems and is resolved in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, and visionOS 26.5.

An app with limited privileges could access sensitive user data without user consent, potentially leading to unauthorized disclosure of confidential information. The vulnerability does not affect integrity or availability. There are no reports of exploitation in the wild. The impact is limited to confidentiality loss on affected Apple devices running vulnerable OS versions prior to the fixed releases.

Apple has released official fixes in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, and visionOS 26.5 that address this vulnerability by adding an additional user consent prompt. Users and administrators should update affected devices to these versions or later to remediate the issue. Patch status is confirmed fixed by the vendor advisory. No additional mitigations are indicated.