Product:
macOS
Summary
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue allows an app to potentially break out of its sandbox. The vulnerability has been fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-28827 |
Exploitation
To exploit this vulnerability, an attacker would need to create a malicious application that takes advantage of the parsing issue in directory paths. By manipulating the path validation process, the app could escape its sandbox environment, leading to unauthorized access to system resources and data.
Affected Products
- macOS Sequoia 15.7.5 – Fixed the parsing issue with improved path validation.
- macOS Sonoma 14.8.5 – Addressed the vulnerability to prevent sandbox escape.
- macOS Tahoe 26.4 – Resolved the directory path handling issue.
Mitigation
To mitigate this vulnerability, users should update their macOS to the latest versions where the issue has been addressed. Regularly applying security updates is crucial to protect against potential exploitation.