>"iOS 18.6 - Undocumented TCC Access to Multiple Privacy Domains via preflight=yes"
https://github.com/JGoyd/Undocumented-System-Behavior-in-iOS-18.6-Silent-TCC-Bypass-and-Data-Movement
https://seclists.org/fulldisclosure/2025/Aug/5

>Covert access to biometric, microphone, calendar, and contact data
>Not visible or controllable via Privacy Settings
>User cannot audit, deny, or revoke this access
>Suggests behavioral profiling or device telemetry below user awareness
>Potentially violates GDPR/CCPA data processing regulations