This vulnerability allows an attacker who has physical access to a locked Apple Watch to view the device’s user contacts, representing a direct breach of user privacy and confidentiality. The flaw exists because the watch’s permissions checks do not properly restrict access to contact data when the device is locked, enabling data exposure without authentication. The impact is the accidental or intentional access to personal contact information, potentially compromising user relationships and sensitive personal data.

Apple Watch devices running watchOS versions prior to 26.4 are affected. The issue has been addressed in watchOS 26.4, which implements improved permissions verification for contact data. No specific version range is listed beyond the fix, so all earlier releases are implicitly impacted.

The attack requires physical possession of the device, so the threat is limited to scenarios in which the watch is stolen or left unattended. No ephemally provided EPSS or CVSS scores exist; however, because the attack vector is physical access and the observable impact is sensitive data exposure, the risk can be considered moderate to high for cases of theft. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation at the time of this report.