Loading vulnerability…
Sensitive User Data Access via Incorrect Authorization in Apple Operating Systems
CVE-2026-112455 is an authorization vulnerability affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Improper authorization state management may allow an application to access sensitive user data without authorization. Apple addressed the issue through improved state management. The affected component, vulnerable functions, and precise triggering conditions are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An application may gain unauthorized access to sensitive user data, compromising user confidentiality. The categories of exposed data and the scope of accessible information are not specified.
Patch, then assume compromise.
Upgrade to the applicable fixed release: iOS 26.7.2 or 27.2; iPadOS 26.7.2 or 27.2; macOS Golden Gate 27.2; macOS Sequoia 15.8.2; macOS Tahoe 26.7.2; tvOS 27.2; visionOS 27.2; or watchOS 27.2. These releases incorporate improved authorization state management.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.