iOS CVE-2026-20688

Local attacker with ability to execute code or supply a malicious app on iOS, iPadOS, macOS (Sequoia 15.7.4 or earlier, Sonoma 14.8.4 or earlier, Tahoe 26.3 or earlier), or visionOS 26.3 or earlier. No user interaction required. Sandbox escape affects system integrity.

Despite the absence of a CVSS score and EPSS data, this vulnerability carries substantial real-world risk due to its nature as a sandbox escape mechanism. Sandbox bypass vulnerabilities are typically rated critical because they undermine the entire security model of application isolation on consumer devices. The fact that Apple coordinated patches across five distinct operating system releases (iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4) suggests Apple considers this a priority issue requiring urgent patching. The attack vector is likely local (requiring malicious app installation), but the technical impact is severe—information disclosure and potential privilege escalation. Without public CVSS vectors or EPSS scores, this cannot be compared to numerical benchmarks, but the sandbox escape classification alone elevates this beyond typical vulnerability severity. No KEV or public POC availability is indicated, reducing immediate exploitation likelihood in the wild, but threat actors will likely prioritize this once patches are released and deltas become analyzable.

A threat actor distributes a seemingly legitimate application through the App Store or a phishing campaign that tricks users into sideloading it. Once installed, the malicious app exploits the path handling vulnerability to escape the sandbox and access sensitive user data such as photos, messages, health records, or authentication tokens stored outside the app's designated container. The attacker could then exfiltrate this data to a remote server or escalate privileges to compromise system-level resources. This scenario is likely achievable without user interaction beyond initial installation, making it a significant risk to any user running an unpatched device.