CVE-2026-28826

CVE-2026-28826 is a logic issue in macOS that could allow a malicious application to escape its sandbox restrictions. The flaw stems from inadequate restrictions in the operating system's sandbox enforcement, enabling an app to bypass intended containment.

Exploitation requires a malicious app to be installed on the system. No special privileges are needed beyond the ability to run code; the app can then leverage the logic flaw to break out of its sandbox. The attack surface is local, as the app must be executed on the target macOS device.

A successful sandbox escape could allow the malicious app to access system resources, user data, or other applications' data that are normally protected by the sandbox. This could lead to unauthorized data access or further compromise of the system.

Apple has addressed this issue in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4 [1][2][3]. Users are advised to update to these versions to mitigate the risk.