CVE-2026-28855: 
macOS vulnerability analysis and mitigation

CVE-2026-28855 is a permissions/improper access control vulnerability in Apple's Screen Time component affecting iOS, iPadOS, and macOS. The flaw allows an app to access protected user data due to insufficient permission restrictions. It affects iOS and iPadOS versions before 26.3, and macOS Tahoe versions 26.0 through before 26.3. Apple disclosed and patched the vulnerability on February 11, 2026, with the CVE entry added to the advisory on March 24, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and was addressed by Apple with "additional restrictions" on permissions within the Screen Time subsystem. The root cause is insufficient enforcement of access controls that allowed an app to bypass Screen Time's data protection boundaries and read protected user data. No public technical write-up or proof-of-concept code has been published. The vulnerability was discovered and reported by security researcher Kirin (@Pwnrin) (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

Successful exploitation allows a malicious app to access protected user data managed by the Screen Time feature, which may include usage statistics, app activity records, and other sensitive information intended to be restricted. The confidentiality impact is rated High, with no integrity or availability impact. The vulnerability affects iOS, iPadOS, and macOS devices running versions prior to 26.3, potentially exposing sensitive parental control and usage data to unauthorized apps (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

Apple has released patches addressing this vulnerability in iOS 26.3, iPadOS 26.3, and macOS Tahoe 26.3. Users and administrators should update affected devices to these versions or later as the primary remediation. No configuration-based workarounds have been published by Apple. Updates can be applied via Settings > General > Software Update on iOS/iPadOS, or System Settings > General > Software Update on macOS (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

The vulnerability was reported by security researcher Kirin (@Pwnrin), who was credited in both the iOS/iPadOS and macOS security advisories. No notable broader industry commentary, media coverage, or significant social media discussion specific to this CVE has been identified beyond the standard Apple security advisory publication.