macOS CVE-2026-28817

Local attacker must execute a sandboxed process on macOS Sequoia (before 15.7.5), Sonoma (before 14.8.5), or Tahoe (before 26.4). Race condition exploitation requires precise timing; no user interaction needed. Affects default sandbox implementations.

While CVSS score and vector are not disclosed by Apple, the vulnerability's classification as a sandbox escape with 'improved state handling' in the fix suggests moderate-to-high severity. The lack of EPSS data, CVSS scoring, and KEV designation indicates this is not yet on the CISA Known Exploited Vulnerabilities list, meaning real-world active exploitation remains unconfirmed or unreported. The race condition nature implies non-trivial exploit complexity (requires precise timing or repetition), which lowers immediate practical risk compared to simple memory corruption. However, sandbox escapes are strategically high-value targets; the presence of patches across three major OS versions suggests Apple assessed this as a priority flaw. Risk is elevated for users running older macOS versions, but patching availability makes this a manageable vulnerability for organizations with timely update processes.

An attacker distributes a malicious sandboxed application (e.g., a seemingly legitimate utility distributed via App Store or third-party installer) that exploits the race condition by repeatedly attempting state-manipulation operations in parallel threads, creating a timing window to bypass entitlement checks. Once the sandbox is circumvented, the malicious process gains access to the user's home directory, keychain, or other restricted resources, enabling credential theft, data exfiltration, or further system compromise. The exploit requires precise timing or repeated attempts, making it difficult to trigger reliably but feasible with careful engineering.