CVE-2025-31192

The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent...

CVE-2025-31192

The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent...

CVE-2025-31192

Summary: CVE-2025-31192 is an Apple Safari-related issue resolved by updated software. The vulnerability could allow a website to access sensor information without user consent. Affected/Root Cause (as per connected docs): Apple Safari and WebKit components exposed a sensor-access behavior that c...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and Apple iPadOS that originates from websites that may be able to access...

PT-2025-31283 · Apple · Macos Sequoia +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sonoma 14.7.7 macOS versions prior to Ventura 13.7.7 macOS versions prior to Sequoia 15.4 Description: A shortcut may be able to bypass sensitive Shortcuts app settings. This issue was addressed by adding an additional...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS that stems from a permissions issue that could result in enabling iCloud storage without user consent...

PT-2025-14005 · Apple · Safari +4

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.4 iOS versions prior to 18.4 iPadOS versions prior to 18.4 macOS Sequoia versions prior to 15.4 Description: The issue allows a website to access sensor information without user consent. This can be achieved by...

PT-2025-11077 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The checkWhetherCallingAppHasAccess function within DownloadProvider.java may allow a bypass of user consent when opening files in shared storage due to a confused deputy condition. This...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

CVE-2024-54463 affects macOS Sequoia 15, where an app could access removable volumes without user consent due to entitlements checks. Apple fixed the issue in Sequoia 15 by improving entitlements handling. Practical impact per sources: potential leakage of data from removable volumes if an app la...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

Apple macOS 信息泄露漏洞

Apple macOS is a suite of specialized operating systems from the U.S.-based Apple Inc. developed specifically for Mac computers. A security vulnerability exists in Apple macOS that stems from a privilege improvement that could cause an application to access removable volumes without user consent...

ASB-A-304497167

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

DeepSeek found to be sharing user data with TikTok parent company ByteDance

A couple of weeks ago we reported on the concerns surrounding data collection and security at DeepSeek, the Chinese AI company which recently made headlines for shaking up the industry after seemingly appearing from nowhere to become top of the app download charts. Now South Korea’s Personal...

Gambling firms are secretly sharing your data with Facebook

While you might think you’re hitting the jackpot, whether you’ve consented to it or not, online gambling sites are playing with your data. Users’ data, including details of webpages they visited and buttons they clicked, are being shared with Meta, Facebook’s parent company. The Observer reports...

CVE-2024-36437

The com.enflick.android.TextNow aka TextNow: Call + Text Unlimited application 24.17.0.2 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity...

ASB-A-372670004

In onCreate of MediaProjectionPermissionActivity.java, there is a possible way to bypass user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-24093

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3. An app may be able to access removable volumes without user consent...