iOS and iPadOS CVE-2026-28873

Exploitation requires a malicious application to be installed on the target iOS or iPadOS device, which necessitates either passing App Store review, distribution via enterprise signing certificates, or installation through sideloading mechanisms where available. The vulnerability cannot be exploited remotely without prior app installation. Once installed, the malicious app requires no user interaction and operates with the standard permissions already granted to it by the user - it simply evades logging of those permission uses in App Privacy Report. No special device configuration or jailbreaking is required. The attack is limited to iOS and iPadOS devices running vulnerable versions (prior to 18.7.9 in 18.x branch, prior to 26.4 in 26.x branch). Exploitation does not require network access at the time of the privacy logging bypass, though the malicious app would typically use network access for data exfiltration, which would normally trigger logging.

Real-world risk is significantly lower than the 7.5 CVSS score suggests. The CVSS vector indicates network-based, unauthenticated exploitation (AV:N/PR:N), which conflicts with the actual requirement that a malicious app must first pass App Store review or sideloading restrictions to be installed on the device. This is fundamentally a local privilege issue requiring prior app installation, not remote exploitation. EPSS score of 0.02% (5th percentile) reflects minimal observed attacker interest, and no active exploitation is confirmed by CISA KEV. The technical impact is limited to confidentiality breach of privacy monitoring logs (C:H/I:N/A:N) - the app still cannot gain additional system access, only hide its activities from user visibility. Primary risk is to targeted surveillance scenarios or privacy-invasive apps attempting to evade detection. For enterprise environments with MDM controls preventing unauthorized app installation, risk is minimal. The vulnerability's severity is primarily reputational and privacy-focused rather than enabling system compromise. Attack complexity is genuinely low once the app is installed, but the prerequisite of installation significantly constrains real-world exploitation scope compared to the CVSS metrics.

An attacker distributes a privacy-invasive app through the App Store or enterprise distribution that has passed initial review. Once installed on a user's device, the app exploits the missing entitlement checks to access sensitive user data such as location, camera, microphone, or network resources without these accesses appearing in the App Privacy Report. The user, believing they can trust the Privacy Report to show all app activities, remains unaware their data is being collected or transmitted, enabling covert surveillance or data exfiltration over extended periods.