CVE-2018-9840: The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the scree...

Security readout for executives and security teams

This CVE affects Signal for iOS before version 2.23.2. Someone with physical access to an affected unlocked device could bypass Signal's in-app screen locker and potentially view protected app content. The issue is local, not remote, but it matters for executives, journalists, legal teams, and others relying on Signal for sensitive communications. Exposure is limited to iOS devices running Signal before 2.23.2 where an attacker can physically interact with the device. Internet-facing systems are not implicated by the provided sources. Handle through mobile app patch compliance, with higher urgency for sensitive roles or users exposed to device loss, seizure, or shared-device scenarios. This is not evidenced as a remote or mass-exploitation issue. Mitigation focus: Update Signal for iOS to version 2.23.2 or later.; Use MDM or app inventory to enforce current Signal versions.; Require strong iOS device passcodes and short auto-lock timers..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.