This vulnerability allows an attacker who has physical access to a locked Apple Watch to view the device’s user contacts, representing a direct breach of user privacy and confidentiality. The flaw exists because the watch’s permissions checks do not properly restrict access to contact data when the device is locked, enabling data exposure without authentication. The impact is the accidental or intentional access to personal contact information, potentially compromising user relationships and sensitive personal data.

Apple Watch devices running watchOS versions prior to 26.4 are affected. The issue has been addressed in watchOS 26.4, which implements improved permissions verification for contact data. No specific version range is listed beyond the fix, so all earlier releases are implicitly impacted.

The attack requires physical possession of the device, limiting its threat to situations where the watch is stolen or left unattended. The CVSS score of 2.4 indicates low severity, and the EPSS score of less than 1% reflects a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no publicly known exploits have been documented. Nonetheless, the sensitive personal data exposed—user contacts—poses a privacy risk if accessed by an unauthorized individual.