CVE-2026-28878: 
macOS vulnerability analysis and mitigation

CVE-2026-28878 is a privacy vulnerability in Apple's Crash Reporter component that allows an app to enumerate a user's installed applications. The flaw was addressed by removing sensitive data from Crash Reporter logs or outputs that could be leveraged for app enumeration. It affects iOS and iPadOS prior to 18.7.7 and 26.4, macOS Sonoma prior to 14.8.5, macOS Tahoe prior to 26.4, macOS Sequoia prior to 15.7.7, tvOS prior to 26.4, visionOS prior to 26.4, and watchOS prior to 26.4. The vulnerability was disclosed on March 24, 2026, and was discovered by Zhongcheng Li from IES Red Team. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apple Advisory iOS 26.4, Apple Advisory macOS Tahoe).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and resides in Apple's Crash Reporter component, which retained sensitive data — specifically information about installed applications — that could be accessed by a malicious app (Apple Advisory iOS 26.4, Apple Advisory tvOS 26.4). Apple's fix involved removing this sensitive data from the Crash Reporter's accessible outputs. The attack vector is network-based per CVSS scoring, requires no privileges, and no user interaction, meaning a malicious app installed on the device could silently query Crash Reporter artifacts to build a profile of all other apps installed on the device. No public proof-of-concept or technical write-up detailing the precise exploitation mechanism has been published as of the time of this report (Feedly).

Successful exploitation allows a malicious app to enumerate all applications installed on a victim's device without any user interaction or elevated privileges, constituting a confidentiality breach (CWE-200). While this vulnerability does not directly enable code execution, data modification, or denial of service, the ability to enumerate installed apps can be used for targeted profiling — for example, identifying the presence of banking, VPN, or security applications to inform further attacks or social engineering. The impact is limited to information disclosure and does not directly facilitate lateral movement, but it can serve as a reconnaissance step in a broader attack chain (Apple Advisory iOS 18.7.7, Feedly).

Apple has released patches across all affected platforms. Users and administrators should update to the following versions or later: iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sonoma 14.8.5, macOS Sequoia 15.7.7, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4 (Apple Advisory iOS 26.4, Apple Advisory macOS Sonoma). For enterprise environments managing iOS/iPadOS fleets, patches should be deployed via Mobile Device Management (MDM) solutions with automatic security updates enforced. No configuration-based workaround is available; patching is the only remediation.

The vulnerability was part of a broader March 2026 Apple security update that addressed over 140 vulnerabilities across Apple's product ecosystem, which received coverage from security-focused outlets and threat intelligence aggregators (CIS Advisory). The SANS Internet Storm Center noted the update in its diary entries. No significant standalone commentary specific to CVE-2026-28878 has been identified, consistent with its medium severity and lack of active exploitation.