# CVE-2026-28878: Apple multiple OS privacy issue in Crash Reporter

Source: https://junglewise.ai/threats/cve-2026-28878-apple-multiple-os-privacy-issue-in-crash-reporter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-28878 · Severity: medium · CVSS 6.5 · Published 2026-03-25

A privacy vulnerability in Apple operating systems could allow a malicious application to see a list of all other apps installed on a user's device. While this does not grant access to the data inside those apps, it allows developers to track user behavior and profile interests without permission. This issue affects iPhones, iPads, Macs, and Apple Watches, and has been resolved in the latest software updates.

Technologies: [Apple iPadOS](https://junglewise.ai/threats/technologies/ipados), [Apple macOS Sequoia](https://junglewise.ai/threats/technologies/macos), [Apple Tvos](https://junglewise.ai/threats/technologies/tvos), [Apple Visionos](https://junglewise.ai/threats/technologies/visionos), [Apple watchOS](https://junglewise.ai/threats/technologies/watchos). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2026-28878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28878 being exploited in the wild.

**How severe is CVE-2026-28878?** Medium severity, with a CVSS score of 6.5, published 25 March 2026.

**Which products and versions are affected?** Apple iPadOS before 18.7.7, 26.0 to 26.4; Apple macOS Sequoia before 15.7.7; Apple macOS Sonoma before 14.8.5; Apple Tvos before 26.4; and 2 more.

**Is there a fix for CVE-2026-28878?** A patch was published on 2026-03-24: Initial release of fixes for iOS 26.4 and others. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28878 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-28878?** Check whether you run Apple iPadOS, Apple macOS Sequoia, Apple macOS Sonoma or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privacy vulnerability (CWE-200) exists in the Crash Reporter component of multiple Apple operating systems. The root cause was the inclusion of sensitive metadata that allowed a local application to enumerate the full list of other installed applications on the device without appropriate permissions. An attacker could exploit this by distributing a malicious app that gathers intelligence on the user's software environment. Apple addressed the issue by removing the sensitive data from the affected component. Patches are available in iOS 18.7.7/26.4, macOS 15.7.7/14.8.5/26.4, and corresponding versions for tvOS, visionOS, and watchOS.

## Affected products

- Apple iOS before 18.7.7, 26.0 to 26.4
- Apple iPadOS before 18.7.7, 26.0 to 26.4
- Apple macOS Sequoia before 15.7.7
- Apple macOS Sonoma before 14.8.5
- Apple macOS Tahoe before 26.4
- Apple tvOS before 26.4
- Apple visionOS before 26.4
- Apple watchOS before 26.4

## Timeline

- 2026-03-24: patched: Initial release of fixes for iOS 26.4 and others.
- 2026-03-25: disclosed: NVD publication date.
- 2026-05-11: advisory: Last modified by Apple to include macOS Sequoia 15.7.7.

## References

- [https://support.apple.com/en-us/126792](https://support.apple.com/en-us/126792)
- [https://support.apple.com/en-us/126793](https://support.apple.com/en-us/126793)
- [https://support.apple.com/en-us/126794](https://support.apple.com/en-us/126794)
- [https://support.apple.com/en-us/126796](https://support.apple.com/en-us/126796)
- [https://support.apple.com/en-us/126797](https://support.apple.com/en-us/126797)
- [https://support.apple.com/en-us/126798](https://support.apple.com/en-us/126798)
- [https://support.apple.com/en-us/126799](https://support.apple.com/en-us/126799)

## Related threats

- [Apple Bluetooth use-after-free vulnerability](https://junglewise.ai/threats/cve-2026-113970-a-use-after-free-issue-was-addressed-with-improved-memory)
- [Apple iOS, iPadOS, macOS, and related platforms rate limit bypass in AirPlay pairing](https://junglewise.ai/threats/cve-2026-113969-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS and iPadOS Bluetooth pairing code rate limit bypass](https://junglewise.ai/threats/cve-2026-113968-a-logic-issue-was-addressed-with-improved-state-management-this)
- [Apple iOS/iPadOS Bluetooth pairing bypass](https://junglewise.ai/threats/cve-2026-113965-this-issue-was-addressed-with-improved-checks-this-issue-is)
- [Apple iOS and iPadOS Bluetooth pairing rate limit bypass in CoreUtils](https://junglewise.ai/threats/cve-2026-113964-a-logic-issue-was-addressed-with-improved-state-management-this)