---
id: "CVE-2026-112567"
kind: "vulnerability"
aliases: ["CVE-2026-112567"]
title: "Apple: malicious app can bypass privacy preferences on several OSes"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple", "endpoints", "infrastructure", "ios", "ipados", "macos", "tvos", "visionos", "watchos"]
not_affected_if: ["already-updated"]
published_at: "2026-10-26T21:17:50+00:00"
first_seen_at: "2026-10-26T21:20:28+00:00"
updated_at: "2026-10-26T21:27:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112567", "first_seen_at": "2026-10-26T21:20:28+00:00"}]
---

# Apple: malicious app can bypass privacy preferences on several OSes

Apple fixed a flaw in its operating systems that lets a malicious application bypass Privacy preferences, the permission controls that gate access to protected data. An attacker who gets a malicious app onto a device can reach data the user had not allowed that app to see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version under Settings > General > Software Update on iOS, iPadOS, tvOS, visionOS and watchOS, or `sw_vers` on macOS.
- Compare against the fixed versions: `27.2` on iOS, iPadOS, tvOS, visionOS, watchOS; `macOS Golden Gate 27.2`; `macOS Sequoia 15.8.2`; `macOS Tahoe 26.7.2`.

## Fix

- Update iOS and iPadOS to `27.2`.
- Update macOS Golden Gate to `27.2`, macOS Sequoia to `15.8.2`, or macOS Tahoe to `26.7.2`.
- Update tvOS, visionOS and watchOS to `27.2`.

## Timeline

- 2026-10-26T21:20:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112567

## From the sources

This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. A malicious application may be able to bypass Privacy preferences.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_