Apple TCC Clickjacking Vulnerability Allowing Unauthorized Access to Photos

A clickjacking vulnerability has been identified in the TCC (Transparency, Consent, and Control) framework of Apple operating systems, including iOS 18, iPadOS 18, and macOS Sequoia 15. This vulnerability allows an application to trick users into granting access to their photos by manipulating the user interface. The issue arises from inadequate handling of out-of-process views, which could be exploited to bypass user consent for accessing the Photos Library.

Impact

Exploitation of this vulnerability could lead to unauthorized access to a user's photo library, allowing apps to view or potentially manipulate personal photos without consent.