Apple Fixes Notification Privacy Flaw That Allowed FBI to Access Deleted Signal Messages
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Apple released iOS 26.4.2 and iPadOS 26.4.2 on April 22, 2026, to patch a critical notification privacy vulnerability that allowed law enforcement to extract Signal message content from iPhones \u2014 even after the app had been deleted.<\/p>\n
The flaw, tracked as CVE-2026-28950, stems from a logging issue in Apple\u2019s notification services. Notifications marked for deletion were unexpectedly retained on the device, potentially leaving sensitive message previews to persist long after users believed they had been wiped. Apple addressed the root cause<\/a> through improved data redaction in its logging framework.<\/p>\n The vulnerability gained public attention after investigative outlet 404 Media reported that the FBI had successfully extracted Signal message notification content from a suspect\u2019s iPhone during a criminal investigation, despite Signal being uninstalled from the device. The retained notification previews provided enough readable content to be forensically valuable to investigators.<\/p>\n Signal acknowledged the patch publicly, praising Apple for acting quickly after the disclosure. In a post on X, the encrypted messaging platform confirmed that the update not only prevents future notifications from lingering for deleted apps but also automatically clears previously retained notification data on affected devices.<\/p>\nSignal Praises Apple\u2019s Swift Response<\/strong><\/h2>\n