Apple’s iOS, iPadOS and macOS platforms suffered a flaw that allowed sandboxed applications to observe app states without the additional restrictions Apple normally imposes. The vulnerability could enable a malicious or compromised app to read sensitive user data that it should not have visibility over. The weakness is classified as CWE‑200, a failed protection against information disclosure, which can compromise confidentiality.

This issue affects Apple iOS and iPadOS devices running iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, iPadOS 26.3 and macOS systems running Sequoia 15.7.4, Sonoma 14.8.4 or Tahoe 26.3. Any sandboxed application installed on these operating systems could potentially exploit the lack of observability restrictions.

The CVSS base score of 5.5 indicates a moderate risk that the flaw might be successfully leveraged. The EPSS score of less than 1% suggests that exploitation attempts are rare at present, and the vulnerability is not featured in the CISA KEV catalog. The likely attack vector is local to the device, relying on a sandboxed app that already has approved installation rights. An attacker would need to supply a specifically crafted app that abuses the observability channel to read sensitive data, with no requirement for elevated privileges or network connectivity. The low exploitation probability mitigates immediate threat, but the potential for data exposure remains.