- A macOS flaw could give hostile apps the highest system privileges
- An NFC tag could trigger an Android app without owner approval
- Android flaw lets apps change Wi-Fi settings without requesting extra permissions
Russian cybersecurity firm Positive Technologies has claimed it discovered 11 security flaws affecting Android and Apple devices.
The company, which is currently under American sanctions, gave the findings to Russian news agency TASS.
Nine of the flaws affected Apple devices and software, while two affected Android, including Pixel phones, and were reportedly rated high severity.
How a tag and an app exposed Android phones
The first Android flaw let attackers use a crafted NFC tag to fetch, set up, and run an app while the owner approved nothing.
The second flaw allowed an app already on the phone to alter network settings, including joining a chosen Wi-Fi network, without any extra permissions, and also let the app add a certificate or adjust proxy parameters, and neither action required the phone owner to confirm anything.
Google resolved both Android flaws in its September 2026 patches, so devices which have installed those patches should no longer face either problem.
The company describes the tag flaw as especially hazardous since holding a phone near the tag suffices to trigger it.
There was no mention of specific Android versions or Pixel models that were vulnerable, so the number of exposed devices remains unknown, but to be safe from malware attacks, get the latest security patch.
What some Apple flaws allowed
According to TASS, the nine Apple flaws covered higher access rights, privacy exposure, and weakened data safeguards.
One macOS flaw allowed a hostile app to obtain the highest level of control over the computer, and another exposed information the system normally protects. The keys used for access could be deleted without the user approving the action.
Another flaw was found inside the kernel of the operating system and could cause a device to fail or corrupt data held in memory.
Apple has released patches for the flaws, although the company did not say which operating system versions carry the fix.
Devices that never received an update stay exposed to every flaw the firm described, whatever patches the vendors have issued.
Owners of older phones and computers that no longer receive vendor updates face the most uncertainty, because a fix never reaches them.
Android owners should check their software version in system settings to confirm the September 2026 patches arrived on their devices.
Neither Apple nor Google acknowledged the Positive Technologies report as expected, but they both released patches fixing these flaws, which implies that the report is legitimate.
