CVE-2026-28833: 
macOS vulnerability analysis and mitigation

CVE-2026-28833 is a permissions/improper access control vulnerability in Apple's iCloud component that allows a local app to enumerate a user's installed applications. It affects iOS, iPadOS, macOS Tahoe, and visionOS versions prior to 26.4. The vulnerability was disclosed and patched on March 24, 2026, as part of Apple's March 2026 security update release. It carries a CVSS v3.1 base score of 6.2 (Medium) (Apple iOS/iPadOS Advisory, Apple macOS Advisory, Apple visionOS Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the iCloud component across affected Apple operating systems. Insufficient permission restrictions allowed a locally-running app to query and enumerate the full list of applications installed by the user — information that should be protected from third-party apps. The fix was implemented by applying additional restrictions to the relevant permissions, as described in Apple's security advisories. The vulnerability was discovered and reported by Zhongcheng Li from the IES Red Team at ByteDance (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

Successful exploitation allows a malicious local app to enumerate the complete list of applications installed on a user's device without requiring any user interaction or elevated privileges. The primary impact is a high confidentiality breach — specifically, disclosure of the user's app inventory — which could be leveraged for targeted social engineering, profiling, or fingerprinting of the device owner. There is no integrity or availability impact; the vulnerability does not enable code execution, data modification, or denial of service (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

Apple has released patches addressing this vulnerability in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4, all released on March 24, 2026. Users and administrators should update all affected Apple devices to version 26.4 or later as soon as possible. No configuration-based workarounds have been published; updating to the patched version is the only recommended remediation (Apple iOS/iPadOS Advisory, Apple macOS Advisory, Apple visionOS Advisory).

The vulnerability was part of a broader Apple security update in March 2026 that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and other platforms, which received general coverage from security news outlets. No specific notable researcher commentary or significant social media discussion focused exclusively on CVE-2026-28833 has been identified. The CIS published an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation, which included this CVE among others (CIS Advisory).