Executive brief
An iOS and macOS app can bypass entitlement checks in Apple's Accessibility framework to gain unauthorized access to sensitive user data without permission. This could allow a malicious application to read private information that users expect to be protected, such as health data, communication history, or financial information, potentially compromising user privacy and trust.
Technical details
The vulnerability is an authorization bypass in the Accessibility framework affecting iOS and macOS systems. An app with local execution privileges can circumvent entitlement checks that are designed to restrict access to sensitive user data. The root cause stems from insufficient validation of application entitlements before allowing access to protected information. The attack vector is local (requires an app already installed on the device), and no user interaction is needed once the malicious app is running. An attacker can read sensitive personal data intended to be protected. The fix involves additional entitlement checks deployed via OS updates (iOS 27, iPadOS 27, macOS Golden Gate 27, and Safari 27).
Affected products
- Apple iOS prior to 27
- Apple iPadOS prior to 27
- Apple macOS prior to Golden Gate 27
- Apple Safari prior to 27
- Apple visionOS prior to 27
Timeline
- 2026-09-14: patched: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, Safari 27, and visionOS 27
- 2026-09-14: advisory: CVE-2026-86897 published