Improper state management in iOS and iPadOS allows private browsing tabs to be accessed without authentication, potentially exposing session data, browsing history, and other sensitive information to any user who can view the tab. The weakness is classified as CWE‑1390 and represents a privacy‑confidentiality breach rather than a remote code execution flaw.

Apple iOS and iPadOS devices running versions prior to iOS 26 and iPadOS 26 are impacted. This includes all iPhone models with iOS earlier than 26 and all iPad models with iPadOS earlier than 26 that have the Private Browsing feature enabled.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, as the flaw permits any user with physical or local access to the device to open a private browsing tab and read its content without authentication. No remote or network‑based exploitation is described in the available data.