One experiment. Two routes. Different answers.
Direct file access was denied while a system preference API returned data from other domains. A separate-process control helped distinguish observed disclosure from writes that remained local to one process.
I investigated whether a sandboxed iOS app could retrieve system preferences through a service even when direct file access was denied. The original report describes an on-device application and a separate WidgetKit extension on an iPhone 14 Pro running iOS 26.4, build 23E246. [E1]
This page focuses on Accessibility and sensitive user-data exposure. The same investigation also produced CVE-2026-43730. These are two tracked issues from one investigation, not two independently discovered research stories.
The experiment compared direct preference-file reads with reads through CFPreferences, mediated by cfprefsd IPC. The report describes denied file access alongside successful retrieval of preferences from other domains. [E1]
Different access paths produced different outcomes. The diagram describes the reported experiment; it does not reconstruct Apple’s internal fix.
This matters because an access decision at the filesystem boundary does not establish the behaviour of the service-mediated path. Each path must be tested in the calling app’s actual security context.
A separate WidgetKit process was used to check behaviour outside the main application process. Witness writes supplied another control: a value visible after a write in one process did not necessarily represent a change another process could observe. [E1]
| Question | Reported observation | Interpretation |
|---|---|---|
| Can the app read the file directly? | Access denied | Direct-file access was blocked. |
| Can a preference API return foreign-domain data? | Data returned | The second path exposed data in the reported runs. |
| Does the observation extend beyond one process? | WidgetKit process also tested | A separate process provided an additional observation. |
| Did witness writes propagate between processes? | No cross-process propagation | Local readback did not establish cross-domain modification. |
The app and widget runs queried different sets of domains. Their raw key counts are not treated as an equivalent workload or a comparative benchmark.
01observe direct_file_read(domain)02observe preference_api_read(domain)03repeat observation in a separate process0405write a witness value in process A06check visibility from process BApple describes the Accessibility issue as an app being able to access sensitive user data. This is the public impact associated with this CVE, rather than a claim that every preference or arbitrary file was exposed. [E2]
What the evidence supports
- The access-path mismatch described in the original submission.
- A separate-process observation and a negative write-propagation control, as recorded in that submission.
- Public Apple acknowledgement of CVE-2026-43664.
What it does not establish
- Arbitrary writes across preference domains.
- A general escape from all sandbox restrictions.
- An independently revalidated binary-level root cause in this edition.
- Exact affected keys or raw payloads absent from the available archive.
- 08 APR 2026Original submission
The combined preference-access investigation was reported to Apple.
- 15 SEP 2026AuthKit split
Apple created a separate AuthKit ticket from the original report.
- PUBLIC RECORDCVE-2026-43664
Apple lists shared Accessibility credit. The disclosure record notes an earlier report from another researcher.
The split date is a correspondence milestone, not the patch-release date. The linked AuthKit advisory covers macOS Tahoe 26.6; the Accessibility advisory covers macOS Golden Gate 27. Neither should be confused with the iOS 26.4 build used for the original experiment.
Original submission and disclosure record
Author’s account of the reported experiment, reviewed on 30 October 2026. Raw logs and the original SandboxEscapePoC project are not included in this edition.
The companion CVE
A separate issue tracked by Apple from the same original investigation.
Open source ↗The user-fingerprinting branch.
The companion CVE from the same preference investigation.
Read the related investigation