iOS and iPadOS CVE-2026-28963

Physical access to the device or the Mac running an active iPhone Mirroring session is required - this is confirmed by CVSS AV:P and the description. The Visual Intelligence feature must be available and invocable in the iPhone Mirroring context, which is a non-default usage scenario requiring prior setup of both iPhone Mirroring (a macOS/iOS continuity feature) and access to Visual Intelligence. Exploitation is NOT remotely possible. Limiting factors include: the attacker must have hands-on physical access to a device or paired Mac, iPhone Mirroring must be actively configured and running, and the target device must be running iOS or iPadOS below 26.5. The attack is not automatable (SSVC: Automatable: no) and cannot be delivered over any network vector.

Real-world risk is materially constrained by the physical access requirement (CVSS AV:P), which eliminates remote and local-network attack scenarios. SSVC confirms exploitation status as none, automatable as no, and technical impact as partial - all consistent with a non-remotely-exploitable information disclosure. EPSS at 0.02% (6th percentile) corroborates that automated or mass exploitation is implausible. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Despite the High confidentiality impact in the CVSS vector, the combination of physical access prerequisite, low EPSS, and SSVC partial impact places this firmly in a lower operational priority tier. This is a real privacy concern for high-value individual targets (e.g., lost or stolen devices) but not a broad enterprise emergency.

An attacker who obtains brief physical access to an unlocked Mac actively running an iPhone Mirroring session invokes the Visual Intelligence feature, which surfaces sensitive user data - such as personal messages or private account information - from the mirrored iPhone without requiring authentication or user confirmation. No public exploit code has been identified at time of analysis.