An access control flaw in Apple operating systems allows a sandboxed application to detect all network connections occurring on the device. The bug bypasses the app sandbox, enabling the app to observe system-wide network activity and potentially identify communication between other applications. This violation of access control (CWE‑284) and unexpected access to system resources (CWE‑693) leads to privacy‑intrusion rather than code execution.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. The flaw exists in all builds prior to the releases that fixed the issue: iOS 26.1, iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, and watchOS 26.1.

The CVSS score of 7.5 highlights a high‑severity privacy issue, while the EPSS score of less than 1% suggests very low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Attacking this flaw requires the ability to run a sandboxed app on the target device, which can be accomplished through normal App Store distribution or sideloading; once executed, the app can enumerate all active network connections but cannot achieve code execution. The likely attack vector is a sandboxed app installed on the target device; this inference is made because the description does not directly specify the exact mechanism.