macOS CVE-2026-28837

Remote unauthenticated attacker can exploit a logic flaw in macOS Tahoe versions prior to 26.4. An app (installed on the victim's system) can access sensitive user data without requiring user interaction or special permissions.

The risk assessment is constrained by missing CVSS and EPSS data, which limits quantitative exploitation probability analysis. However, several factors establish this as a material security concern: Apple's decision to patch indicates active vulnerability validation; the information disclosure impact directly threatens user privacy; the logic issue classification suggests the flaw is likely exploitable by malicious applications without requiring advanced exploitation techniques; and no KEV or public POC status is documented, suggesting either pre-disclosure handling or recent patch availability. The attack vector is likely 'Local' (application-based) with low to medium complexity, as the flaw requires app installation but not necessarily user interaction beyond normal app execution. Real-world priority is elevated for macOS users, particularly those running versions significantly behind 26.4, but lower than memory-safety or remote code execution vulnerabilities in terms of attack surface.

A malicious or compromised application installed on an affected macOS system could exploit the logic flaw to bypass sandbox restrictions and access sensitive user data such as credentials, location history, calendar events, or personal documents without triggering permission prompts or audit logs. The attack requires only that the app be installed and executed—no special user interaction or elevated privileges are necessary, making this a practical threat vector for supply-chain compromises where legitimate apps are trojanized or third-party app stores distribute malicious variants.