CVE-2026-84626 in iOS
Summary
by MITRE • 09/15/2026
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability described constitutes an information disclosure flaw rooted in inadequate state management within the operating system's application environment. This issue allows a malicious or compromised application to infer details about the software ecosystem present on the device, specifically identifying which other applications are installed by the end-user. In modern mobile and desktop operating systems like iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, apps operate within strict sandboxing boundaries designed to prevent unauthorized access to data belonging to other processes or the system itself. However, when state management is not rigorously enforced or validated, an attacker can exploit subtle behavioral differences in how the operating system handles requests related to application existence checks. These techniques often involve probing for specific URL schemes, deep link handlers, or file paths that behave differently depending on whether a target application is present or absent. By analyzing response times, error codes, or UI changes triggered by these probes, an attacker can build a fingerprint of the user's installed software inventory without directly accessing private data stores.
From a technical perspective, this flaw aligns with CWE-200, which defines Information Exposure, and more specifically CWE-1349, where sensitive information is revealed through side channels or improper state handling. The operational impact of such an exploit extends beyond simple curiosity; it facilitates targeted social engineering attacks by revealing the user's professional tools, communication platforms, financial applications, or security software. For instance, knowing that a specific banking app or password manager is installed allows an attacker to craft highly convincing phishing messages tailored to those services. Furthermore, this information can be used for supply chain targeting, where attackers focus their efforts on compromising widely used enterprise applications known to be present on the victim's device. The ability to enumerate installed apps also aids in determining the version of specific software if combined with other fingerprinting techniques, potentially allowing attackers to check against databases of known vulnerabilities associated with those particular app versions.
The mitigation for this vulnerability involves rigorous enforcement of sandbox policies and improved state management mechanisms within the operating system kernel and application runtime environments. Developers must ensure that APIs used for checking application availability do not leak timing information or distinct error states that can be programmatically detected to infer presence. The fix implemented in iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, and subsequent versions likely includes stricter validation of inter-process communication requests and normalization of responses for non-existent applications to prevent differential analysis. Additionally, the operating system may employ randomization techniques or uniform error handling to obscure whether a specific app is installed when queried by an unprivileged process. For users, maintaining up-to-date software installations as provided in these security updates is critical to closing this information leak channel. Security researchers and penetration testers should also be aware that such enumeration tactics are often categorized under ATT&CK technique T1592, which covers Gather Victim Host Information, specifically the sub-technique of Application Discovery. Mitigating this risk requires both vendor-side hardening of system APIs and developer-side adherence to privacy-preserving design principles that minimize data leakage through behavioral side channels.