iOS CVE-2026-28855

A malicious app installed on iOS 26.0-26.2, iPadOS 26.0-26.2, or macOS Tahoe 26.0-26.2. The app can access protected user data without explicit user permission or elevated privileges. No user interaction required beyond initial app installation.

While specific CVSS and EPSS scores are not provided in the vulnerability data, the risk profile can be assessed through available signals: This is classified as an information disclosure vulnerability with attack vector local (requires installation of a malicious app) and likely low complexity once the permissions gap is identified. The lack of a CVSS vector suggests either the vulnerability details are embargoed or under review, but Apple's decision to issue security updates across three major OS lines indicates moderate-to-high real-world risk assessment internally. The vulnerability is not listed as actively exploited (KEV status unknown), and no public POC is available based on provided intelligence. However, the fact that Apple patched this across iOS, iPadOS, and macOS simultaneously suggests it is a substantive security issue affecting a core OS component. Unlike high-CVSS bugs that are difficult to exploit, this permissions bypass is likely automatable once understood—any malicious app could leverage it without user interaction beyond installation.

A malicious actor distributes a trojanized app through unofficial channels or a compromised app store listing that appears to be a legitimate utility (e.g., a flashlight or weather app). Once installed, the app exploits this permissions bypass to silently access the user's contacts, call history, location data, and photos without triggering permission prompts or appearing in the permission settings. The attacker exfiltrates this data to a remote server, enabling identity theft, stalking, or targeted phishing attacks. Because the exploit requires only local app installation with no special user interaction beyond initial download, it represents a scalable attack vector against large numbers of users.