Apple Patches 18 Vulnerabilities in visionOS 26 Allowing Access to Sensitive User Data

Apple has released visionOS 26, addressing eighteen security flaws that could allow unauthorized access to sensitive user data. The update, issued on 15 September 2025, covers a wide range of components in the Apple Vision Pro platform. According to Apple’s policy, the company confirms security issues only after patches are available, and visionOS 26 follows this practice.

Notable fixes include the AppleMobileFileIntegrity component, where a permissions issue could have allowed apps to read or modify protected files, and two Bluetooth flaws, CVE-2025-43354 and CVE-2025-43303, which now feature improved data redaction to prevent data exposure through Bluetooth activity.

The Spell Check module (CVE-2025-43190) and multiple WebKit bugs (CVE-2025-43356, CVE-2025-43272, CVE-2025-43343, CVE-2025-43342) are addressed, with stronger input validation and memory protections to stop misbehaving content from leaking data or crashing processes. Researchers credited include Mickey Jin, Hossein Lotfi, Csaba Fitzl and others, and Apple has also fixed issues across the kernel (CVE-2025-43359), DiskArbitration (CVE-2025-43316) and System (CVE-2025-43347) components. Users and organisations should install visionOS 26 immediately to safeguard Vision Pro devices.