CVE-2026-28833

Vulnerability

Overview

CVE-2026-28833 is a permissions issue in Apple operating systems that allows an app to enumerate a user's installed applications. The root cause is a missing or insufficient permission check that would normally prevent an app from querying the list of installed apps on the device. Apple addressed this by adding additional restrictions to the relevant system APIs.

Exploitation

An attacker would require an attacker to have an app installed on the target device. No special network position or authentication bypass is needed beyond the app's own capabilities. The vulnerability is local in nature, meaning the attacker must first get the malicious app onto the device through social engineering or other means.

Impact

An attacker exploiting this vulnerability can learn which apps are installed on the user's device. This information can be used to tailor further attacks, such as targeting specific app vulnerabilities or profiling the user. The impact is limited to information disclosure and does not allow code execution or data theft directly.

Mitigation

Apple has released patches for this issue in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 [1][2][3]. Users are advised to update their devices to the latest available versions. There is no indication of active exploitation in the wild at the time of publication.