Apps being able to bypass a restriction put on them by the OS always matter.
Whether that means there's a _feature_ lacking there, is another question.
Apps being able to bypass a restriction put on them by the OS always matter.
Whether that means there's a _feature_ lacking there, is another question.
The OS provides restrictions and permissions so that the user can apply them to apps.
If the user chooses to free certain apps from restrictions, that should be their choice.
But if a piece of software overrides the users' choice, that certainly qualifies as a CVE.
This is an important distinction! The user must always have final say.
Whether an app breaks out of the sandbox and steals my vacation photos, or the OS sets new restrictions I can't remove, both are wrong.
Any piece of software has to act in service of the user, and ONLY the user. It must not do things or set restrictions without the users consent. No means no.