CVE-2026-28938 in iOS
Summary
by MITRE • 09/14/2026
A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability described involves a privacy concern related to application behavior on Apple mobile operating systems, specifically affecting iOS and iPadOS versions prior to 26.6. The core issue stems from an application's ability to collect or infer sensitive data about the user through indirect means rather than direct access to protected resources. This type of flaw is typically categorized under CWE-359, which refers to Exposure of Personal Information Without Proper Consent, as it involves the unauthorized collection or inference of personal identifiers that can be used to profile an individual without their explicit knowledge or permission.
The technical mechanism behind this vulnerability allows applications to fingerprint users by leveraging device-specific attributes, system configurations, or behavioral patterns that remain consistent across sessions. While Apple has implemented strict sandboxing and privacy controls in recent iOS versions, certain APIs or system behaviors may still expose unique identifiers such as hardware characteristics, network configuration details, or software version strings. When an application aggregates these data points, it can create a distinct digital signature for each device, effectively bypassing traditional anonymity measures like cookie deletion or app reinstallations. This capability enables long-term tracking of user activity across different applications and sessions, undermining the privacy expectations set by platform-level protections.
From an operational perspective, this fingerprinting technique poses significant risks to user confidentiality and data integrity. Attackers or malicious actors can use these fingerprints to correlate activities across multiple services, build detailed profiles of individual users, or even facilitate targeted phishing campaigns based on inferred interests and behaviors. The impact extends beyond simple privacy violations; it contributes to a broader ecosystem where user tracking is pervasive and difficult for end-users to detect or mitigate through standard settings alone. This aligns with ATT&CK technique T1592, which covers Gather Victim Host Information, specifically the sub-technique of collecting device fingerprints that can be used for identification purposes in cyber attacks.
To address this issue, Apple has implemented fixes in iOS 26.6 and iPadOS 26.6 by restricting access to certain system attributes or altering how they are exposed to applications. Developers must ensure their apps comply with these updated privacy guidelines by minimizing the data collected during runtime and avoiding reliance on stable identifiers for tracking purposes. Users should keep their devices updated to the latest software versions to benefit from these mitigations. Additionally, enabling features such as App Tracking Transparency can provide an additional layer of control over how applications monitor user activity across other companies' apps and websites. Regular audits of app permissions and data access patterns are also recommended to identify any remaining privacy leaks that might not be covered by system-level updates.