Apple identified an issue involving improper state management that could allow an application to track a user across multiple apps and websites without the user’s permission. The flaw does not provide code execution or traditional denial‑of‑service capabilities; it simply enables a malicious app to gather and correlate personal activity data, resulting in a privacy breach and potential identity tracking.

The vulnerability impacts Apple’s mobile platforms: iOS, i available in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27. Devices running earlier OS versions are susceptible.

No EPSS score is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting low exploitation probability at this time. An attacker would need to supply or entice a user to install a malicious application that exploits the state‑management flaw; therefore, the attack vector is likely through the App Store or sideloading. The primary impact remains the unauthorized aggregation of personal data, which could enable targeted phishing or advertising campaigns. Due to the lack of exploitation metrics, the risk is considered moderate but should be addressed promptly because privacy exposure can accumulate over time.