CVE-2025-43444

Vulnerability

Overview

CVE-2025-43444 is a permissions issue in Apple operating systems that could allow an app to fingerprint the user. The root cause is a missing restriction that allowed an app to query which other applications are installed on the device, a technique known as app fingerprinting. Apple addressed this by adding additional restrictions to prevent such queries [1][3].

Exploitation

An attacker would need to convince a user to install a malicious app on their device. No additional authentication or network access is required beyond the app's normal permissions. The app could then silently enumerate installed applications, building a unique profile of the user based on their app choices [1][3].

Impact

Successful exploitation allows the app to identify what other apps a user has installed, which can be used to fingerprint the user. This can be used for targeted advertising, phishing, or to infer sensitive information about the user's habits, profession, or interests. The impact is considered medium severity (CVSS 5.3) as it primarily affects privacy rather than data integrity or system availability.

Mitigation

Apple has released patches for this issue in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1 [1][2][3][4]. Users are strongly advised to update their devices to the latest available software versions. No workarounds have been published.