Description
This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.
Published: 2026-09-14
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure of User-Installed Applications
Action: Patch Now
AI Analysis

Impact

A flaw in the state management of Apple Safari, iOS, iPadOS, and macOS allows a malicious website to determine which applications are installed on a user’s device. The weakness is classified as CWE‑642, indicating improper handling of stored state data. The primary impact is limited to accidental disclosure of installed application information, which could assist an attacker in tailoring further exploits.

Affected Systems

Apple Safari, iOS, iPadOS, and macOS Golden Gate releases prior to version 27 are affected. The security update that resolves this issue is delivered in Safari27, iOS 27, iPadOS 27, and macOS Golden Gate 27 and later releases.

Risk and Exploitability

The vulnerability carries a CVSS score of 4.3, reflecting moderate severity. It is not listed in the CISA KEV, and the EPSS score of less than 1% indicates a very low probability of exploitation. Successful exploitation yields only information disclosure about installed applications, which may aid in subsequent attacks.

Generated by OpenCVE AI on September 16, 2026 at 08:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Apple Security updates that include Safari 27, iOS 27, iPadOS 27, and macOS Golden Gate 27 or later.
  • Use web filtering or anti‑malware controls to reduce the likelihood of users visiting malicious sites that could exploit the flaw.
  • Restrict third‑party site access to application enumeration features via device privacy settings or group policy controls.

Generated by OpenCVE AI on September 16, 2026 at 08:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Title Installed Application Disclosure via State Management Vulnerability

Wed, 16 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Tue, 15 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Title Installed Application Disclosure via State Management Vulnerability

Tue, 15 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple safari
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple safari

Mon, 14 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-642
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Safari
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-14T22:51:38.853Z

Reserved: 2026-09-01T21:13:17.749Z

Link: CVE-2026-84518

cve-icon Vulnrichment

Updated: 2026-09-14T22:51:32.656Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:28.350

Modified: 2026-09-16T01:08:06.107

Link: CVE-2026-84518

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T08:45:19Z

Weaknesses
  • CWE-642

    External Control of Critical State Data