macOS CVE-2026-28839

Without a CVSS score, CVSS vector, EPSS score, or KEV status, traditional quantitative risk assessment is limited. However, the risk profile can be inferred from available signals: (1) Apple's multi-version patching across three major OS releases indicates this was deemed significant enough for backport fixes, suggesting non-negligible real-world impact; (2) the Information Disclosure tag indicates the attack does not require privilege escalation or system compromise beyond app execution—a local attacker or compromised third-party app can exploit this; (3) the absence of KEV listing and public POC suggests this was either a zero-day caught during development or a low-profile bug discovered via responsible disclosure; (4) the vague description ('improved checks') suggests the underlying issue was subtle or required specific conditions, implying moderate-to-low exploitability in practice. The real-world risk is moderate: while the technical impact (data exfiltration) is severe, the attack surface requires local code execution, which limits widespread automated exploitation. Organizations running current or near-current macOS versions should prioritize patching, but this is not a critical emergency equivalent to a wormable remote code execution vulnerability.

A user downloads what appears to be a legitimate application from a third-party source or receives it via social engineering. The application, designed by an attacker, runs with user privileges and exploits this access control weakness to read files in the user's home directory (e.g., browser cookies, saved passwords, SSH keys, or documents containing sensitive information) that should be protected by macOS's security framework. The attacker exfiltrates this data to a remote server. Since the attack requires local code execution, it is not wormable across networks, but combined with other social engineering or supply-chain attack vectors, it becomes a practical threat for targeted users.