CVE-2026-84626 Overview
CVE-2026-84626 is an information disclosure vulnerability affecting multiple Apple operating systems. A local application can identify what other apps a user has installed on the device. Apple addressed the issue with improved state management across its OS families. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
A locally installed app can enumerate other installed applications without user consent, enabling fingerprinting, targeted phishing, and reconnaissance for follow-on attacks.
Affected Products
- iOS and iPadOS prior to 26.7 and prior to 27
- macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and macOS Golden Gate prior to 27
- tvOS prior to 27, visionOS prior to 27, and watchOS prior to 27
Discovery Timeline
- 2026-09-14 - CVE-2026-84626 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-84626
Vulnerability Analysis
The vulnerability allows a sandboxed application to determine which other applications are installed on an Apple device. On Apple platforms, the list of installed apps is considered sensitive because it can reveal user identity, banking relationships, medical conditions, and workplace software. Apple restricts this information to prevent silent profiling of users by third-party apps.
The root of the issue lies in inconsistent state management within a system component that exposes app presence indirectly through observable side effects. A malicious app can query these side effects to infer installation of specific bundle identifiers, bypassing the intended privacy boundary. Apple's fix introduces improved state management to prevent leakage of this metadata across app boundaries.
Root Cause
The underlying weakness maps to [CWE-200]. State transitions in an affected system service leaked observable differences depending on whether a target app was installed. A local app could observe those differences and deduce the presence or absence of other bundle identifiers without holding any entitlement to query installed apps.
Attack Vector
Exploitation requires local code execution in the form of an installed application with standard, low privileges and no user interaction. An attacker would typically deliver a benign-looking app through the App Store or an enterprise distribution channel. The app then performs installation reconnaissance to build a targeting profile before delivering follow-on payloads or phishing content. See Apple's advisories for platform-specific technical notes and fixed builds.
No public proof-of-concept code is available for this issue.
Detection Methods for CVE-2026-84626
Indicators of Compromise
- Applications making high-frequency calls to system APIs used for URL scheme handling, app launch services, or shared resource lookups.
- Unexpected outbound telemetry from third-party apps containing lists of bundle identifiers or normalized app fingerprints.
- Mobile Device Management (MDM) reports showing devices running vulnerable OS builds after the patch release window.
Detection Strategies
- Inventory managed Apple devices with MDM and flag those running OS versions earlier than the fixed builds listed in the Apple advisories.
- Review third-party apps that request broad URL scheme handlers or perform unusual canOpenURL: style probing patterns.
- Correlate app behavior telemetry with network egress to identify apps exporting installed-application inventories.
Monitoring Recommendations
- Track OS version compliance across the fleet and enforce upgrade policies for iOS 26.7 or later, macOS Sequoia 15.8 or later, and equivalents.
- Monitor App Store and enterprise-distributed apps for privacy-manifest changes that expand access to device metadata.
- Alert on newly installed apps that immediately generate outbound network traffic containing structured app inventories.
How to Mitigate CVE-2026-84626
Immediate Actions Required
- Update all managed Apple devices to the fixed OS builds: iOS and iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
- Push updates through MDM with enforced deadlines for user acknowledgment.
- Audit installed third-party applications and remove any that are unnecessary or unvetted.
Patch Information
Apple addressed CVE-2026-84626 with improved state management. Full details for each affected platform are published in the vendor advisories: Apple Support Document #149034, Apple Support Document #149035, Apple Support Document #149036, Apple Support Document #149037, Apple Support Document #149038, Apple Support Document #149041, Apple Support Document #149042, and Apple Support Document #149043.
Workarounds
- Restrict app installation to vetted App Store or MDM-approved applications until devices are patched.
- Configure MDM privacy and app restriction profiles to limit sideloaded and enterprise-signed apps.
- Educate users to avoid installing apps from unknown developers that request broad device access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
