CVE-2026-28833: Apple iPadOS Information Disclosure Flaw

CVE-2026-28833 Overview

CVE-2026-28833 is a permissions vulnerability affecting multiple Apple operating systems. The flaw allows an installed application to enumerate the list of other apps installed on a user's device. Apple addressed the issue by adding further restrictions to the affected component. The weakness maps to [CWE-284] Improper Access Control. Local access is required to abuse the issue, and exploitation does not impact integrity or availability — only confidentiality of installed application inventory.

Critical Impact

A malicious or curious app can silently enumerate a user's installed applications, exposing inventory data that supports fingerprinting, targeted phishing, and reconnaissance for follow-on attacks.

Affected Products

• Apple iOS and iPadOS prior to 26.4
• Apple macOS Tahoe prior to 26.4
• Apple visionOS prior to 26.4

Discovery Timeline

• 2026-03-25 - CVE-2026-28833 published to NVD
• 2026-05-10 - Last updated in NVD database

Technical Details for CVE-2026-28833

Vulnerability Analysis

The vulnerability resides in the access control layer that governs how third-party apps query device state on iOS, iPadOS, macOS Tahoe, and visionOS. An app running in the standard user context can enumerate the list of installed applications without triggering an entitlement check or user consent prompt. The disclosure scope is limited to installed-app metadata, but that data is sensitive on consumer and enterprise devices alike. Apple's advisory describes the remediation as additional restrictions, indicating the platform now enforces stricter authorization on the affected API surface.

Root Cause

The root cause is an improper access control condition [CWE-284] in the system component that returns app inventory information. The affected interface did not adequately validate whether the calling process held the necessary entitlement before returning results. Any sandboxed app could therefore retrieve data intended to remain isolated between app domains.

Attack Vector

Exploitation requires local code execution in the form of an installed application. No user interaction and no elevated privileges are needed. An attacker would publish or sideload an app that issues the affected query at runtime, then exfiltrate the resulting inventory to a remote server. The data supports profiling for banking app users, enterprise MDM footprints, or competitor reconnaissance, and it enables tailored phishing lures referencing apps the victim actually uses. Because no verified proof-of-concept code has been published, defenders should describe the abuse pattern rather than synthesize exploit code.

Detection Methods for CVE-2026-28833

Indicators of Compromise

• Third-party apps making unexpected outbound network connections shortly after first launch, particularly to unfamiliar telemetry endpoints.
• App Store or enterprise distribution submissions that request entitlements unrelated to their stated function.
• Devices running iOS, iPadOS, macOS Tahoe, or visionOS below version 26.4 in managed fleets.

Detection Strategies

• Inventory managed Apple devices through MDM and flag any endpoint still running a pre-26.4 OS build.
• Review app vetting pipelines for binaries that reference private APIs or undocumented system queries used to list installed apps.
• Correlate user-reported phishing attempts that reference specific installed apps with recent installs of unvetted third-party software.

Monitoring Recommendations

• Track MDM compliance reports for OS version drift across iPhone, iPad, Mac, and Apple Vision Pro fleets.
• Monitor network egress from mobile devices for unusual data uploads following new app installations.
• Subscribe to Apple security advisories 126792, 126794, and 126799 for related follow-up disclosures.

How to Mitigate CVE-2026-28833

Immediate Actions Required

• Update affected devices to iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, or visionOS 26.4 as soon as the build is available in your update channel.
• Enforce minimum OS version policies through MDM to block non-compliant devices from accessing corporate resources.
• Audit installed third-party applications and remove any from untrusted publishers, especially on devices handling sensitive data.

Patch Information

Apple resolved the issue in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 by adding additional permission restrictions to the affected component. Refer to the Apple Security Advisory #126792, Apple Security Advisory #126794, and Apple Security Advisory #126799 for build-specific details.

Workarounds

• Restrict app installation to vetted sources and enforce App Store review through device supervision profiles.
• Apply MDM configuration profiles that block sideloading and limit enterprise app deployment to signed, reviewed binaries.
• Educate users to avoid installing apps from unknown developers until devices receive the 26.4 update.

# Example MDM compliance check for minimum OS version
profiles status -type enrollment
sw_vers -productVersion | awk -F. '{ if ($1<26 || ($1==26 && $2<4)) print "NON-COMPLIANT: Update to 26.4"; else print "COMPLIANT" }'