Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
1.9

Apple iOS keyboards leak typed data from hidden fields

CVE-2014-4450 · published 12 years ago
Summary

iOS versions before 8.1 may capture what you type in form fields that have autocomplete turned off, even when those fields are not meant to be read. This can allow a malicious app or website to see passwords or other credentials. Update devices to iOS 8.1 or later, or disable the QuickType prediction feature if you cannot upgrade.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple iphone_os <= 8.0.2
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Original advisory text
The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplete attribute, which makes it easier for attackers to disco...
The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplete attribute, which makes it easier for attackers to discover credentials by reading credential values within unintended DOM input elements.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
1.9 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-255Credentials Management Errors
Timeline
Published22 Oct 2014
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-4450 · NVD
Track software like this
Free during beta