CVE-2025-43436CWE-288

CVE-2025-43436

High · published November 4, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

⚡ Attention iOS and macOS users! A permissions issue could let apps peek into your installed app list—like a nosy neighbor checking out your mailbox! 📦 This vulnerability is akin to a hotel staff member who has the keys to every room but can’t resist glancing into each guest’s luggage when they’re not around. It’s a violation of privacy that’s absolutely not welcome! If left unaddressed, an attacker could enumerate your installed apps, revealing sensitive information about your usage patterns and interests. This could lead to targeted phishing attacks or other malicious activities that exploit this information.

Put simply

This vulnerability is akin to a hotel staff member who has the keys to every room but can’t resist glancing into each guest’s luggage when they’re not around. It’s a violation of privacy that’s absolutely not welcome! The vulnerability arises from insufficient restrictions on app permissions, allowing one app to access the list of installed applications on the device without proper authorization.

What to do

If left unaddressed, an attacker could enumerate your installed apps, revealing sensitive information about your usage patterns and interests. This could lead to targeted phishing attacks or other malicious activities that exploit this information. Make sure to update your iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices to version 26.1 or higher to close this gap. Regularly review app permissions and only install apps from trusted sources. You've got this! Update your devices and carry on with confidence, knowing you're keeping your digital life safe! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00581 · 47.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-11-04T07:15Z
Affected products (5)
ProductVersionsFixed in
apple/ipados< 26.126.1
apple/iphone_os< 26.126.1
apple/tvos< 26.126.1
apple/visionos< 26.126.1
apple/watchos< 26.126.1
References (5)
EPSS history
Timeline
  • 04 NOV 01:17Z
    A permissions issue was addressed with additional restrictions
    cvelistv5