CVE-2016-4740

Vulnerability

In Apple iOS versions prior to 10, the Handoff feature for Messages does not verify that a user has signed into Messages before displaying message content. This oversight allows the system to show messages without proper authentication. The vulnerability affects all devices running iOS versions before 10 when Handoff is enabled.

Exploitation

An attacker with physical access to the device or the ability to trigger Handoff (e.g., on a paired device) could potentially view message content without the user having signed into Messages. The exact exploitation vector is unspecified in available references, but it relies on the Handoff feature being active.

Impact

Successful exploitation results in unauthorized disclosure of sensitive information from Messages, including private conversations. The attacker gains access to message content without the intended authentication, compromising confidentiality.

Mitigation

The issue is addressed in iOS 10, released on September 13, 2016 [1]. Users should update to iOS 10 or later to remediate the vulnerability. No workarounds are documented in the available references.