A permissions flaw in Apple operating systems permits a malicious application to enumerate other user‑installed apps. This privilege escalation can reveal sensitive information about the user’s app usage pattern, compromising privacy and potentially facilitating further targeted attacks. The weakness maps to CWE‑200, information disclosure.

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are impacted. The vulnerability affects iOS and iPadOS versions 18.7.3 and 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2. All other Apple OS versions are not listed as vulnerable.

The CVSS score of 9.8 reflects a high severity with a critical potential for privacy compromise. However, the EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low exploitation probability in the wild. The likely attack vector is a malicious application that can leverage the excess permission to detect installed apps; based on the description, it is inferred that the exposure arises from insufficient permission constraints.