# CVE-2026-43664: Accessibility Data Exposure | David Strnadel

Canonical source: https://davidstrnadel.com/research/cve-2026-43664/
Author: David Strnadel
Source content last updated: 2026-10-30T18:33:27+00:00

> Text edition of the public page. Sources, shared attribution and evidence limits are retained.

CVE-2026-43664 Technical note · report reconstruction

## The boundary held. On only one path.

The sensitive-data branch of a shared investigation into system preference access.

[David Strnadel](https://davidstrnadel.com/) / Security & AI Research 30 October 2026 · ~4 min

- **Reported test build:** iOS 26.4 · 23E246
- **Access path:** CFPreferences / cfprefsd
- **Evidence:** Original-report reconstruction
- **Attribution:** Shared Apple credit

The short version 60 SEC

## One experiment. Two routes. Different answers.

Direct file access was denied while a system preference API returned data from other domains. A separate-process control helped distinguish observed disclosure from writes that remained local to one process.

Accessibility [Go to the mechanism ↓](https://davidstrnadel.com/research/cve-2026-43664/#mechanism)

01

## Context & scope

I investigated whether a sandboxed iOS app could retrieve system preferences through a service even when direct file access was denied. The original report describes an on-device application and a separate WidgetKit extension on an iPhone 14 Pro running iOS 26.4, build `23E246`. [\[E1\]](https://davidstrnadel.com/research/cve-2026-43664/#e1)

**Reading the evidence**

This technical note reconstructs the experimental logic from my original submission and disclosure record. The original local project and raw test archive have not been recovered for this edition. Observations below are attributed to that submission; they are not presented as a freshly reproduced test.

This page focuses on **Accessibility** and sensitive user-data exposure. The same investigation also produced [CVE-2026-43730](https://davidstrnadel.com/research/cve-2026-43730/). These are two tracked issues from one investigation, not two independently discovered research stories.

02

## The access-path mismatch

The experiment compared direct preference-file reads with reads through `CFPreferences`, mediated by `cfprefsd` IPC. The report describes denied file access alongside successful retrieval of preferences from other domains. [\[E1\]](https://davidstrnadel.com/research/cve-2026-43664/#e1)

Figure 01 / Two access paths Reported observations · conceptual diagram

Sandboxed application

Direct file access **Denied**

CFPreferences → cfprefsd IPC **Foreign-domain data returned**

Different access paths produced different outcomes. The diagram describes the reported experiment; it does not reconstruct Apple’s internal fix.

This matters because an access decision at the filesystem boundary does not establish the behaviour of the service-mediated path. Each path must be tested in the calling app’s actual security context.

**Observation versus root-cause explanation**

The submission attributed the exposure to permissive preference policy. This edition has not independently revalidated that internal policy or Apple’s cross-build implementation. The access-path observation and Apple’s CVE outcome are presented separately.

03

## Controls that matter

A separate WidgetKit process was used to check behaviour outside the main application process. Witness writes supplied another control: a value visible after a write in one process did not necessarily represent a change another process could observe. [\[E1\]](https://davidstrnadel.com/research/cve-2026-43664/#e1)

| Question | Reported observation | Interpretation |
| --- | --- | --- |
| Can the app read the file directly? | Access denied | Direct-file access was blocked. |
| Can a preference API return foreign-domain data? | Data returned | The second path exposed data in the reported runs. |
| Does the observation extend beyond one process? | WidgetKit process also tested | A separate process provided an additional observation. |
| Did witness writes propagate between processes? | No cross-process propagation | Local readback did not establish cross-domain modification. |

The app and widget runs queried different sets of domains. Their raw key counts are not treated as an equivalent workload or a comparative benchmark.

**Listing 01** The logic of the control Experimental design · pseudocode

```text
observe direct_file_read(domain)
observe preference_api_read(domain)
repeat observation in a separate process

write a witness value in process A
check visibility from process B
```

This is an explanatory outline of the reported controls, not recovered PoC source, actual API signatures, or a log transcript.

04

## CVE-specific outcome

Apple describes the Accessibility issue as an app being able to access sensitive user data. This is the public impact associated with this CVE, rather than a claim that every preference or arbitrary file was exposed. [\[E2\]](https://davidstrnadel.com/research/cve-2026-43664/#e2)

### What the evidence supports

- The access-path mismatch described in the original submission.

- A separate-process observation and a negative write-propagation control, as recorded in that submission.

- Public Apple acknowledgement of CVE-2026-43664.

### What it does not establish

- Arbitrary writes across preference domains.

- A general escape from all sandbox restrictions.

- An independently revalidated binary-level root cause in this edition.

- Exact affected keys or raw payloads absent from the available archive.

05

## One report, two outcomes

- 08 APR 2026 **Original submission** The combined preference-access investigation was reported to Apple.

- 15 SEP 2026 **AuthKit split** Apple created a separate AuthKit ticket from the original report.

- PUBLIC RECORD **CVE-2026-43664** Apple lists shared Accessibility credit. The disclosure record notes an earlier report from another researcher.

The split date is a correspondence milestone, not the patch-release date. The linked AuthKit advisory covers macOS Tahoe 26.6; the Accessibility advisory covers macOS Golden Gate 27. Neither should be confused with the iOS 26.4 build used for the original experiment.

06

## Evidence & references

E1

### Original submission and disclosure record

Author’s account of the reported experiment, reviewed on 30 October 2026. Raw logs and the original SandboxEscapePoC project are not included in this edition.

E2

### Apple · Accessibility

Public attribution and impact for CVE-2026-43664.

[Open source ↗](https://support.apple.com/en-us/149034)

E3

### The companion CVE

A separate issue tracked by Apple from the same original investigation.

[Open source ↗](https://davidstrnadel.com/research/cve-2026-43730/)

**What would strengthen this edition**

A recovered original test project, exact queried domains and keys, and the app/widget evidence pairs would support a reproducible appendix. Until then, this article explicitly preserves the distinction between reported behaviour and independently rechecked artifacts.

Continue exploring

## The user-fingerprinting branch.

The companion CVE from the same preference investigation.

[Read the related investigation](https://davidstrnadel.com/research/cve-2026-43730/)