Apple iOS CVE-2026-65345

Requires a malicious or compromised app already running locally on the device (AV:L), plus user interaction (UI:R) such as installing and launching that app; there is no remote or network-triggerable path. The app leverages a permissions-restriction gap to reach user-sensitive data outside its intended scope. Limiting factors: attacker must first get their app onto the device and get the user to run it, impact is confidentiality-only (no data modification or DoS), and any device already updated to iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 is not affected.

This is a genuine but moderate-severity local access-control flaw (CWE-284), not a network-exploitable critical. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 5.5) tells the real story: exploitation requires code already running on the device (a malicious or compromised app) plus user interaction, and yields confidentiality impact only (C:H) with no integrity or availability effect. Every corroborating signal points to low real-world urgency rather than a fire drill: EPSS is 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code is identified. No SSVC decision data was provided. There is no conflict between the CVSS vector and the terse Apple description ('An app may be able to access user-sensitive data') - both are consistent with a sandbox/permission-scoping bypass reachable only from local app context. Bottom line: patch on a normal cadence; this is a privacy/data-exposure issue exploitable only after an attacker already has an app on the device, not a remotely wormable priority.

A user installs a seemingly benign app (e.g., from a store or sideloaded) that abuses a permissions-restriction gap to read user-sensitive data it should not be able to reach, such as data belonging to other apps or the system. No public proof-of-concept exists, and the attack requires the malicious app to run locally with some user interaction, so it is a targeted privacy-exfiltration path rather than mass exploitation.