macOS CVE-2026-28828

While CVSS scoring data is not available for this CVE, the vulnerability presents moderate to elevated real-world risk based on several factors. The information disclosure nature (confirmed via tagging) combined with multi-version affected status suggests this could impact a significant user base. The fact that Apple issued patches across three different macOS versions (Sequoia, Sonoma, and the newer Tahoe) within coordinated security updates indicates this was treated as a priority issue. The absence of CVSS/EPSS scores makes comparative risk assessment difficult, but the remediation strategy of code removal rather than parameter adjustment suggests this was a clear security boundary violation. Attack complexity is likely low since the vulnerability allows unprivileged apps to access protected data, and the attack vector appears to be local (requiring app execution on the target system). The lack of public POC or KEV confirmation does not diminish concern, as permissions issues are often discovered through internal security review rather than public disclosure.

A malicious or compromised third-party application installed on a user's Mac could leverage this permissions bypass to read sensitive user information such as passwords, authentication tokens, browsing history, or personal documents without triggering permission prompts or user awareness. The attack would require only that the application be executed on the target system (local attack vector), making it a realistic threat for scenarios where users have installed apps from questionable sources or where corporate devices have been compromised through phishing or supply chain attacks. Once exploited, the data breach would be difficult to detect as the unauthorized access would bypass the normal macOS permission model that typically alerts users to sensitive data access.