Product:
macOS
Summary
A race condition was addressed with improved handling of symbolic links. This issue allows an app to potentially access Contacts without user consent. The vulnerability has been fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-28924 |
Exploitation
The vulnerability can be exploited by an attacker who can send specially crafted requests over the network. By leveraging the race condition, the attacker may gain unauthorized access to sensitive user data, such as Contacts, without requiring user interaction or consent.
Affected Products
- macOS Sequoia 15.7.7 – Fixed the race condition issue.
- macOS Sonoma 14.8.7 – Addressed the vulnerability with improved symbolic link handling.
- macOS Tahoe 26.5 – Resolved the issue to prevent unauthorized access to Contacts.
Mitigation
To mitigate this vulnerability, users should update their macOS to the latest versions provided by Apple. Regularly applying security updates is essential to protect against potential exploits and unauthorized access to sensitive information.