CVE-2026-84606 in iOS
Summary
by MITRE • 09/15/2026
A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The disclosed vulnerability represents a significant privacy flaw within the operating system's handling of device identifiers, specifically affecting iOS, iPadOS, macOS, and visionOS platforms in version twenty-seven. The core technical issue stems from insufficient sanitization or randomization mechanisms associated with persistent identifiers that applications utilize to track user activity across different installation states. In modern mobile and desktop ecosystems, apps frequently rely on unique hardware or software-based identifiers to maintain session continuity, personalize content, or enforce licensing agreements. However, when these identifiers are not properly reset upon application deletion or reinstallation, they create a persistent fingerprinting vector that allows third-party applications to link user behavior across distinct installation cycles. This flaw undermines the fundamental privacy expectation that deleting an app should sever its ability to track the individual associated with the device.
From a technical perspective, this vulnerability aligns closely with CWE-200, which classifies as Information Exposure where sensitive information is accessible to unauthorized actors without explicit consent or necessity. The mechanism likely involves the retention of non-resettable identifiers such as MAC addresses, serial numbers, or improperly rotated advertising IDs that remain static even after a complete uninstallation and subsequent reinstallation of the software package. By preserving these unique strings across reinstallations, the operating system inadvertently facilitates cross-session tracking that bypasses standard privacy controls designed to reset user consent states. This behavior contradicts modern privacy frameworks like GDPR and CCPA, which mandate clear mechanisms for users to erase their digital footprint upon request or application removal.
The operational impact of this flaw is substantial regarding user surveillance and data aggregation capabilities available to malicious actors or overly aggressive advertisers. An application exploiting this vulnerability can construct a persistent profile of the device owner by correlating activity from previous installations with current usage patterns, effectively bypassing opt-out mechanisms that rely on app deletion as a reset trigger. This capability enables long-term behavioral profiling without user knowledge, leading to potential misuse for targeted advertising, price discrimination, or more severe threats such as stalking and doxxing if the identifier is linked to other personally identifiable information through data brokerage practices. The persistence of this tracking vector erodes trust in the platform's privacy guarantees and exposes users to continuous surveillance that extends beyond the lifecycle of any single application instance.
Mitigation strategies primarily rely on the vendor-provided software updates included in iOS twenty-seven, iPadOS twenty-seven, macOS Golden Gate twenty-seven, and visionOS twenty-seven. These updates implement stricter enforcement of identifier rotation policies, ensuring that unique identifiers are regenerated or invalidated upon app uninstallation to prevent cross-install linkage. Developers must also adhere to privacy best practices by avoiding the use of persistent hardware-based IDs for tracking purposes and instead utilizing platform-specific advertising identifiers that respect user opt-out preferences. Furthermore, implementing regular audits using ATT&CK techniques related to Device Identification, such as T1074 or T1592, can help identify residual data retention issues in custom applications before deployment. Users should ensure their devices are updated immediately upon release of these patches and review app permissions to minimize unnecessary access to device-specific attributes that could be leveraged for fingerprinting.