CVE-2025-46288: 
macOS vulnerability analysis and mitigation

CVE-2025-46288 is a permissions/improper access control vulnerability in Apple's App Store component that allows a locally installed app to access sensitive payment tokens. It affects iOS and iPadOS before 26.2, macOS Tahoe before 26.2, visionOS before 26.2, and watchOS before 26.2. The vulnerability was disclosed on December 12, 2025, when Apple released the patched OS versions, and was formally published in the NVD on December 17, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Advisory iOS/iPadOS, Apple Advisory macOS).

The root cause is classified as CWE-284 (Improper Access Control), stemming from insufficient permission restrictions in the App Store component across affected Apple platforms. A locally installed app could exploit this flaw to read sensitive payment tokens — such as those used by Apple Pay or in-app purchase flows — that should be protected by stricter access controls. Apple addressed the issue by applying additional restrictions to the relevant permissions model. No public technical write-up or proof-of-concept code has been identified for this specific vulnerability (Apple Advisory iOS/iPadOS, Apple Advisory macOS).

Successful exploitation results in unauthorized disclosure of sensitive payment tokens by a malicious app running on the affected device, representing a high confidentiality impact with no integrity or availability impact. The exposed tokens could potentially be leveraged for fraudulent transactions or to facilitate further attacks against payment systems. The scope is limited to the local device and does not provide a direct path for remote exploitation or lateral movement (Apple Advisory iOS/iPadOS, Apple Advisory watchOS).

Apple has released patches addressing this vulnerability in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, and watchOS 26.2, all released on December 12, 2025. Users should update their devices to these versions or later as soon as possible via the standard software update mechanism. No configuration-based workarounds have been published by Apple; updating to the patched release is the only recommended remediation (Apple Advisory iOS/iPadOS, Apple Advisory macOS, Apple Advisory visionOS, Apple Advisory watchOS).

The vulnerability was discovered and reported by researchers identified as "floeki" and Zhongcheng Li from the IES Red Team of ByteDance, as credited in Apple's security advisories. Coverage of the iOS 26.2 release was broad in tech media, though most attention focused on the two actively exploited WebKit zero-days (CVE-2025-43529 and CVE-2025-14174) patched in the same update rather than CVE-2025-46288 specifically. CIS Security issued an advisory noting multiple vulnerabilities in Apple products patched in this release (Apple Advisory iOS/iPadOS).