CVE-2026-28878: Apple iPadOS Information Disclosure Flaw

CVE-2026-28878 Overview

A privacy vulnerability has been identified across multiple Apple operating systems that allows malicious applications to enumerate installed apps on a user's device. This information disclosure flaw stems from sensitive data exposure within the system, which Apple has addressed by removing the problematic data. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS platforms, representing a significant privacy concern for users across Apple's entire ecosystem.

Critical Impact

A malicious app installed on a user's device could enumerate all installed applications, potentially revealing sensitive information about the user's habits, interests, and activities—enabling targeted attacks or privacy violations.

Affected Products

• Apple iOS (versions prior to 18.7.7 and 26.4)
• Apple iPadOS (versions prior to 18.7.7 and 26.4)
• Apple macOS Sonoma (versions prior to 14.8.5) and macOS Tahoe (versions prior to 26.4)
• Apple tvOS (versions prior to 26.4)
• Apple visionOS (versions prior to 26.4)
• Apple watchOS (versions prior to 26.4)

Discovery Timeline

• 2026-03-25 - CVE-2026-28878 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28878

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw allows applications running on Apple devices to access information about other installed applications without proper authorization. This type of information disclosure can be leveraged by attackers for reconnaissance purposes, enabling them to identify potential attack surfaces based on what software users have installed.

The ability to enumerate installed applications presents several privacy and security risks. Attackers can use this information to craft targeted phishing campaigns, identify vulnerable applications for exploitation, or build behavioral profiles of users. For enterprise environments, this could expose sensitive information about business tools and security software in use.

Root Cause

The root cause of this vulnerability lies in improper handling of sensitive application metadata within Apple's operating systems. The system inadvertently exposed data that allowed applications to query and discover information about other installed apps. Apple's fix addresses this by removing the sensitive data that enabled this enumeration capability.

This type of vulnerability typically arises from insufficient isolation between application sandboxes or from system APIs that inadvertently leak information about installed software through return values, timing differences, or accessible file system artifacts.

Attack Vector

The attack vector for CVE-2026-28878 is network-based, requiring an attacker to first get a malicious application installed on the target device. Once installed, the malicious app can silently enumerate other applications without requiring user interaction or elevated privileges.

The exploitation scenario involves:

1. A user installs a seemingly legitimate application that contains malicious code
2. The malicious application queries system interfaces to enumerate installed apps
3. The collected data is exfiltrated to attacker-controlled infrastructure
4. Attackers use this information for targeted attacks or surveillance

Since no proof-of-concept code has been publicly released, the specific technical mechanism exploited by this vulnerability is described in Apple's security advisories. The vulnerability allows apps to query system information that should be protected by the application sandbox model.

Detection Methods for CVE-2026-28878

Indicators of Compromise

• Unusual application behavior involving queries to system APIs that enumerate installed software
• Network traffic containing lists of installed applications being transmitted to external servers
• Applications requesting or accessing data outside their normal operational scope
• Suspicious app store installations from unknown or untrusted developers

Detection Strategies

• Monitor for applications making repeated system calls to enumerate installed software packages
• Implement application whitelisting to prevent installation of untrusted apps
• Use Mobile Device Management (MDM) solutions to audit installed applications and detect anomalies
• Review application permissions and behaviors through security tooling

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions capable of monitoring application behavior on Apple devices
• Configure logging to capture application installation events and unusual system API calls
• Implement network monitoring to detect data exfiltration attempts containing device inventory information
• Regularly audit installed applications against approved software lists

How to Mitigate CVE-2026-28878

Immediate Actions Required

• Update all affected Apple devices to the latest patched versions immediately
• Review recently installed applications and remove any suspicious or unnecessary software
• Enable automatic updates on all Apple devices to ensure timely security patches
• Implement application installation restrictions through MDM for enterprise environments

Patch Information

Apple has released security updates to address this vulnerability across all affected platforms. Users should update to the following versions:

• iOS and iPadOS: Update to version 18.7.7 or 26.4
• macOS Sonoma: Update to version 14.8.5
• macOS Tahoe: Update to version 26.4
• tvOS: Update to version 26.4
• visionOS: Update to version 26.4
• watchOS: Update to version 26.4

For detailed information, refer to the official Apple Security Advisories: Apple Security Advisory #126792, Apple Security Advisory #126793, Apple Security Advisory #126794, Apple Security Advisory #126796, Apple Security Advisory #126797, Apple Security Advisory #126798, and Apple Security Advisory #126799.

Workarounds

• Restrict app installations to only those from the official App Store and verified enterprise sources
• Implement strict MDM policies to control which applications can be installed on managed devices
• Regularly audit installed applications and remove any that are no longer needed or appear suspicious
• For enterprise environments, consider implementing network segmentation to limit data exfiltration pathways

# Check current iOS/iPadOS version via MDM or manually
# Settings > General > About > Software Version

# For macOS, check version from terminal:
sw_vers -productVersion

# Verify system is updated to patched version
# macOS Sonoma should be 14.8.5 or later
# macOS Tahoe should be 26.4 or later