Apple CVE-2026-28863

Without published CVSS scores or EPSS data, the real-world risk assessment must rely on the vulnerability's characteristics and scope. The attack vector appears to be local (requiring app installation), which increases the barrier to exploitation compared to network-based vectors. However, the broad scope across four major Apple operating systems, combined with the information disclosure impact and the common practice of users installing untrusted applications, elevates the practical risk. The availability of an official patch in versions 26.4 across all platforms suggests Apple considered this a priority security issue warranting coordinated fixes. The lack of KEV status or public POC availability in provided references does not diminish risk, as fingerprinting vulnerabilities are frequently exploited in the wild for advertising networks and persistent tracking. This represents a moderate to high real-world risk due to its multi-platform nature and direct impact on user privacy.

An attacker distributes a seemingly benign application (such as a game, utility, or lifestyle app) through official or third-party app stores. Upon installation, the app leverages the permissions issue to access device identifiers, hardware characteristics, and user behavioral signals that should require explicit permission. The app collects this fingerprinting data and transmits it to a backend service controlled by the attacker, where it can be correlated across multiple devices and services to build a persistent user profile for targeted advertising, identity fraud, or surveillance purposes. Since the vulnerability exists in the permission architecture itself rather than requiring user interaction beyond app installation, users remain unaware their devices are being fingerprinted.