Description

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-25T20:16:55.283Z",
  "pubdate": "2026-08-25T20:16:55.283Z",
  "executiveSummary": "A permissions-based vulnerability exists within iOS and iPadOS that permits unauthorized applications to enumerate the list of software installed on the operating system.\nThe vulnerability is classified as an information disclosure issue resulting from insufficient sandbox or permission restrictions.\nThis flaw affects iOS 26.5 and iPadOS 26.5 and earlier versions.\nSuccessful exploitation allows a malicious application to determine the presence of other applications on a user's device without explicit consent.\nThis capability significantly impacts user privacy, as it facilitates the profiling of a user's digital behavior, interests, and potentially sensitive organizational affiliations based on the installed application landscape.\nThe vulnerability does not require complex authentication or elevated privileges; it is inherent to the application's execution environment if the sandbox is inadequately enforced.\nRisk implications include reconnaissance for targeted social engineering, tracking, or identifying specific software versions that may have their own exploitable vulnerabilities.",
  "technicalDetails": "The vulnerability arises from a flaw in the inter-process communication (IPC) or kernel-level query mechanisms that handle system-wide application visibility.\nUnder normal secure operations, the iOS/iPadOS sandbox model restricts an application's ability to inspect the metadata or binary presence of other applications unless they share a specific container or are part of a trusted suite. In the affected versions, the security policy governing these queries was overly permissive, allowing an untrusted application to perform an enumeration of the installed application bundle identifiers.\nThe attack flow begins when an unprivileged malicious application executes a system call or requests information via a specific framework API designed for querying installed apps. Because of the missing or improperly validated restrictions, the operating system returns a comprehensive list of installed applications rather than a restricted or empty set.\nThe root cause is likely an improper implementation of access control checks (or 'entitlements' checks) during the processing of these API requests. The system fails to enforce that the requesting process holds the necessary authorization before permitting access to the application database.\nThis vulnerability is classified as an information disclosure flaw. By querying the system, an attacker can construct a unique 'fingerprint' of the user's device based on the specific set of installed applications. This footprint can then be used to track the user across sessions or to tailor malicious payloads based on known vulnerabilities within the installed third-party apps identified.\nThere are no specific network exposure requirements for this exploit, as the vulnerability is local and can be triggered entirely within the context of a malicious application running on the target device.\nPost-exploitation, an attacker gains visibility into the ecosystem of the victim's device. While this does not grant code execution or persistent root access on its own, it serves as a critical reconnaissance phase for more sophisticated multi-stage attacks, allowing the attacker to determine the most viable targets for further exploitation within the system."
}