CVE-2026-28863 Details
Description
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to fingerprint the user.
A permissions vulnerability in the Sandbox Profiles component of Apple iOS, iPadOS, tvOS, visionOS, and watchOS has been identified. This issue allows apps to fingerprint users, potentially compromising user privacy. The vulnerability arises from insufficient restrictions, enabling unauthorized access to user-specific data or behaviors.
Users can update to iOS 26.4, iPadOS 26.4, tvOS 26.4, visionOS 26.4, or watchOS 26.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.apple.com/en-us/126792 | [email protected] | Vendor Advisory |
| https://support.apple.com/en-us/126797 | [email protected] | Vendor Advisory |
| https://support.apple.com/en-us/126798 | [email protected] | Vendor Advisory |
| https://support.apple.com/en-us/126799 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple ipados | < 26.4 |
CPE
Remediation
| |
| apple iphone os | < 26.4 |
CPE
Remediation
| |
| apple tvos | < 26.4 |
CPE
Remediation
| |
| apple visionos | < 26.4 |
CPE
Remediation
| |
| apple watchos | < 26.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 10, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | New CVE Received | [email protected] |