macOS CVE-2026-28820

This vulnerability presents moderate to high real-world risk despite limited public technical details. The attack vector is local (applications running on the user's system), requiring the malicious application to already be installed or the user to be socially engineered into running it. No CVSS score or EPSS probability is available, limiting quantitative risk assessment. However, the information disclosure impact is significant: user data exposure can lead to identity theft, privacy violations, and downstream attacks. The absence of a CVE entry in the CISA KEV (Known Exploited Vulnerabilities) catalog indicates no confirmed active exploitation in the wild at the time of analysis, reducing immediate urgency. However, organizations should prioritize patching macOS Tahoe systems to version 26.4 or later, as the vulnerability's local attack complexity combined with the broad scope of affected systems (all macOS versions) makes it valuable for targeted attacks and supply-chain compromises. The delayed disclosure (CVE from 2026) and subsequent patching suggest Apple treated this as a priority fix.

An attacker distributes a seemingly legitimate application through social engineering or a compromised third-party app store. Upon installation and execution, the application leverages this vulnerability to bypass macOS sandboxing restrictions and read sensitive user data such as browser history, credentials stored in the Keychain, financial information, or personal documents without triggering user permission prompts. The attacker then exfiltrates this data to a remote server for resale or use in targeted follow-on attacks. No publicly documented proof-of-concept code exists to date, but the local attack vector and approval-bypass nature of the flaw make it a practical target for commodity malware and targeted campaigns.