CVE-2026-84636

A sandboxed iOS app with no special entitlements can call SCDynamicStoreCreate and SCDynamicStoreCopyValue to read the current WiFi SSID (SSID_STR) and router MAC address (ARPResolvedHardwareAddress) directly from configd's network state store. This bypasses the com.apple.developer.networking.wifi-info entitlement enforcement applied to CNCopyCurrentNetworkInfo, and enables router-MAC-based geolocation (WiGLE/Google) to ~10–30m precision without location permission.

Additional data exposed without entitlement:

• State:/Network/Interface/en0/AirPort → SSID, channel, auth type (WPA2), RF noise level
• State:/Network/Service//IPv4 → ARPResolvedHardwareAddress (router MAC)
• State:/Network/Global/DNS → DNS server IPs (ISP or corporate network identification)
• State:/Network/Service//DHCP → DHCP lease start/expiry, raw server options
• com.apple.MobileBluetooth → Bluetooth powered state (on/off)
• com.apple.MobileInternetSharing → personal hotspot state, connected device count
• com.apple.sharing:/AutoUnlock/Enabled|InProgress → Apple Watch Auto-Unlock state
• State:/IOKit/LowBatteryWarning → low battery warning active (1/0)
• State:/IOKit/PowerManagement/SystemLoad/Detailed → battery level tier, thermal level

Patched in iOS 27 & iPadOS 27 & tvOS 27 as CVE-2026-84636