Apple Fixes iOS Bug That Lets VoiceOver Spill Passwords
Published On: October 7, 2024
Apple has recently rolled out critical updates for iOS and iPadOS—version 18.0.1—to resolve serious vulnerabilities within their systems. These updates specifically address two major security flaws, one of which has reportedly compromised some users' passwords through Apple's VoiceOver feature, an accessibility tool. This flaw, dubbed CVE-2024-44204, was discovered within the Passwords app and has allowed passwords stored on iPhones and iPads to be read aloud by VoiceOver without user authorization.
The issue, which Apple categorized as a logic error, affected several iPhone and iPad models. Devices such as the iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch (3rd generation and later), iPad Air (3rd generation and later), and iPad mini (5th generation and later) were impacted. Apple swiftly fixed the vulnerability by enhancing validation processes within the app.
Another critical bug, CVE-2024-44207, was identified in the iPhone 16 series. This flaw allowed the microphone in the iMessage app to capture audio before the microphone indicator (the orange dot on the screen) was turned on, creating potential privacy concerns. Apple also addressed this by implementing improved checks on how the microphone operates.
Apple has urged all users to update their devices immediately to mitigate these risks. The update is available by going to Settings > General > Software Update on affected devices. The fix comes at a time when Apple's first-party Passwords app has only recently been launched as part of iOS 18, highlighting the importance of regular security updates to maintain user privacy and data protection.