Apple: Apple Maps privacy bug: Why iPhone users don’t need to worry

A recently reported Apple Maps bug was reportedly allowing apps to collect user location data without permission. Several apps could have exploited this privacy bug to their advantage. According to a report by 9to5Mac, a Brazilian food delivery app named iFood accessed a user’s location data in iOS 16.2 even after the user denied all location access to the app. The Cupertino-based tech giant started rolling out to the general public last month. Among other new features, the latest iOS version also included a list of security updates.
The Apple Maps privacy bug that allowed an app to “bypass Privacy preferences” was also addressed by one of these fixes. The report also claims that the company has clarified that iPhone users “were never at risk” due to this security flaw. The company also denied the report regarding the Brazillian food delivery app accessing user locations without permission in iOS 16.2.
How iPhone users were not at risk
As per the report, Apple has explained that the Maps vulnerability that was patched “could only be exploited from unsandboxed apps on macOS.” Moreover, the company added the fix to all of Apple’s software updates including iOS and iPadOS, tvOS, and watchOS. This was done by the company as the codebase is shared by all these operating systems.
Apple has also claimed that “the suggestion that this vulnerability could have allowed apps to circumvent user controls on iPhone is false.” The company also concluded that the app was not circumventing user controls through any mechanism.” The Apple Maps security flaw was first discovered by an anonymous researcher.

What Apple had to say
In a statement to 9to5Mac, Apple said, “At Apple, we firmly believe users should choose when to share their data and with whom. Last week we issued an advisory for a privacy vulnerability that could only be exploited from unsandboxed apps on macOS. The codebase that we fixed is shared by iOS and iPadOS, tvOS, and watchOS, so the fix and advisory was propagated to those operating systems as well, despite the fact that they were never at risk. The suggestion that this vulnerability could have allowed apps to circumvent user controls on iPhone is false.
A report also incorrectly suggested an iOS app was exploiting this or another vulnerability to bypass user control over location data. Our follow up investigation concluded that the app was not circumventing user controls through any mechanism.”