Apple iOS CVE-2026-84491

The attacker must already be able to execute code as an installed third-party application on the target Apple device (CVSS PR:L, AV:L) - this is not remotely reachable and not unauthenticated in the network sense. The app must invoke the specific framework/API whose permission check was weakened; no special user interaction (UI:N), elevated privileges, jailbreak, or physical access to a locked device is required once the app is running, and the vulnerable code is present in default configurations across all five affected platform families. Exploitation is limited by the fact that the attacker needs a delivery path for the malicious app (App Store review, sideloading, MDM/enterprise signing, or a compromised developer certificate), by the impact being read-only disclosure of user data rather than code execution or data modification (C:H/I:N/A:N), and by the need to target a device that has not yet been updated to iOS/iPadOS 26.7 or 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27.

Multiple signals point to a moderate, locally-scoped issue rather than a crisis. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5) confirms the attacker must already have the ability to run code as a local app on the device, cannot reach the target over the network, and gains only data disclosure. EPSS is 0.20% at the 10th percentile, there is no CISA KEV listing, and SSVC rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. The single notable amplifier is that Apple platforms are ubiquitous and the affected base is enormous, so a working exploit would have significant privacy impact at scale - but nothing in the current intelligence suggests that exploit exists publicly. One data caveat: the tag list includes 'Authentication Bypass', which does not match a CWE-284 confidentiality-only permissions issue; treat that tag as unverified. Also note the macOS CPE and EUVD affected-version list (macOS 0 <27) indicate macOS Golden Gate is affected alongside the mobile/watch/vision platforms.

An attacker convinces a user to install - or slips through review with - an app on an iPhone, iPad, Mac, Apple TV, Apple Vision, or Apple Watch. Once running with only normal app privileges, the app calls the poorly restricted system API, which returns protected user data such as personal records or files that the app's entitlements should never have permitted. The app then exfiltrates that data to an attacker-controlled server. No public proof-of-concept is known, so this remains a theoretical but low-complexity (AC:L, UI:N) local attack.