---
id: CVE-2025-46288
title: A permissions issue was addressed with additional restrictions
summary: >-
  A permissions issue was addressed with additional restrictions. This issue is
  fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS
  26.2. An app may be able to access sensitive payment tokens.
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-284
vendor: apple
product: ipados
affected:
  - ipados < 26.2
  - iphone_os < 26.2
  - macos < 26.2
  - visionos < 26.2
  - watchos < 26.2
patched:
  - ipados 26.2
  - iphone_os 26.2
  - macos 26.2
  - visionos 26.2
  - watchos 26.2
published: '2025-12-17'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T20:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-46288'
references:
  - url: 'https://support.apple.com/en-us/125884'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/125886'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/125890'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/125891'
    label: product-security@apple.com
tags:
  - nvd
epss: 0.00165
epssPercentile: 0.05186
ingestedAt: '2026-09-30T20:23:19.459Z'
---

## Overview

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.

## Affected

- `ipados < 26.2`
- `iphone_os < 26.2`
- `macos < 26.2`
- `visionos < 26.2`
- `watchos < 26.2`

## Remediation

Upgrade past the affected range:

- `ipados 26.2`
- `iphone_os 26.2`
- `macos 26.2`
- `visionos 26.2`
- `watchos 26.2`