Technical impact
Apple identified an issue involving improper state management that could allow an application to track a user across multiple apps and websites without the user’s permission. The flaw does not provide code execution or denial‑of‑service capabilities; it simply enables a malicious app to gather and correlate personal and potential identity tracking.
Affected Systems
The vulnerability impacts Apple’s mobile platforms: iOS, iPadOS, and watchOS. The issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, and watchOS 27. Devices running earlier OS versions are susceptible.
Risk and Exploitability
The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation risk at this time. An attacker would need to supply or entice a user to install a malicious application that exploits the state‑management flaw; therefore, the attack vector is likely through the App Store or sideloading. The primary impact remains the unauthorized aggregation of personal data, which could enable targeted phishing or advertising campaigns. Due to the very low exploitation probability, the risk is considered moderate but should still be addressed promptly because privacy exposure can accumulate over time. The CVSS score is 7.5, indicating high severity.
