Buzz
With the recent .3 update, Apple has addressed a critical security flaw related to the Apple Maps app, allowing third-party apps to collect user location data even without permission.
Although the impact of this security flaw is uncertain, at least one app has managed to exploit user location data. Brazilian journalist Rodrigo Ghedin reports it could be iFood, a billion-dollar food delivery app in Brazil, whose behavior was detected accessing user locations on iOS 16.2. Notably, even when users denied all location access permissions to the app, it could still exploit Apple Maps.
A user stumbled upon this inadvertently due to glitches with iOS 16.2, and upon review, discovered the app self-accessing, bypassing iOS settings intended to restrict app access to certain phone features.Another notable aspect is 'how long has this loophole existed?' How many apps have quietly exploited it, and how much location data has been collected?According to descriptions, this flaw appears on iPhone 8 and later, all versions of iPad Pro, iPad Air 3rd generation and later, 5th generation iPad, and 5th generation iPad mini. This security flaw has enabled apps to bypass user privacy settings.
Apple has refrained from commenting on these issues, as the listed vulnerabilities are few and 'reserved' for a few devices. Additionally, the impact of this security flaw will diminish over time, as most iOS users have upgraded to iOS 16.3 (or downloaded and installed patches) for their devices.
