Apple iOS, iPadOS, macOS, visionOS CVE-2026-28993

The vulnerability requires that a malicious or compromised application be installed and running on the target device with standard user privileges (PR:L in CVSS). The flaw is triggered when the app attempts to access protected user-sensitive data categories (contacts, photos, health, location, etc.) through the normal iOS/iPadOS/macOS APIs. Exploitation does not require user interaction at the moment of attack (UI:N); once the app is installed and has executed, it can silently bypass the consent check. The vulnerability does not apply to system apps or apps running with elevated privileges; it is bounded to standard sandbox-confined applications. Exploitation is limited to data exfiltration within the confidentiality boundary of the user's own device (S:U); the attacker cannot laterally escalate to other users' data or affect system integrity. Non-affected configurations include fully patched versions (iOS 18.7.9+, iPadOS 26.5+, macOS Sequoia 15.7.7+, macOS Sonoma 14.8.7+, macOS Tahoe 26.5+, visionOS 26.5+) or devices with strict third-party app installation policies enforced via Mobile Device Management (MDM).

The risk profile is significantly constrained by multiple factors. CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector requiring low-complexity exploitation and low privileges, with high confidentiality impact but no integrity or availability harm-a classic local data exfiltration scenario. However, the extremely low EPSS score of 0.02% (7th percentile) strongly contradicts the CVSS severity, suggesting that real-world exploitation likelihood is minimal despite the theoretical ease of execution. This discrepancy may reflect that the vulnerability requires specific app installation or compromise preconditions unlikely to occur in typical deployments, or that the data targeted is less valuable than CVSS assumes. The absence of a CISA KEV listing and no reported public exploit code further reinforce that this is a low-priority issue from an operational standpoint. The authentication requirement (PR:L) and lack of user interaction (UI:N) mean a locally authenticated attacker or installed app can trigger the vulnerability without user knowledge, but attackers must first gain local system presence-a substantial prerequisite. Defenders should prioritize patching, but this is not a critical emergency; threat models focused on app-based lateral movement or compromised third-party apps are the primary concern.

An attacker distributes a malicious or compromised third-party app through the App Store or sideloading mechanisms. Once installed and granted basic system access by the user, the app silently exploits the consent-bypass vulnerability to access sensitive user data such as contact lists, photos, location history, or health information without triggering the expected permission prompts. The attacker exfiltrates this data to a remote server, and the user remains unaware because no permission dialogs or system notifications are displayed.