Apple macOS CVE-2026-28853

Exploitation requires the attacker to already have local code execution as an unprivileged app on the macOS host (AV:L, PR:L), i.e. the ability to run a malicious or compromised application; it is not remotely reachable. No additional user interaction is needed for the escalation (UI:N). Exploitation is limited to macOS versions before Sequoia 15.8 and Tahoe 26.7 - patched systems are not affected, and the flaw cannot be triggered without the prior foothold, making it a post-compromise escalation step rather than an initial-access vector. Apple's description ('An app may be able to elevate privileges') and the fix via 'improved checks' indicate the condition is invoking the privileged operation whose checks were insufficient.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw (CWE-269, Improper Privilege Management): an attacker needs low-level local access (PR:L) and no user interaction, with full confidentiality, integrity, and availability impact on the host once exploited. This is consistent with Apple's own terse summary ('An app may be able to elevate privileges') - the attacker already runs code as an unprivileged app and leverages the flaw to gain higher privileges. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or weaponization; this is no public exploit identified at time of analysis. Because exploitation requires prior local code execution (PR:L, AV:L), this is a second-stage/chaining vulnerability rather than a remote entry point, which lowers its standalone urgency relative to a network-facing CRITICAL. That said, privilege escalation on a widely deployed OS is a valuable post-compromise primitive, so it remains a meaningful patch priority, especially for multi-user or managed Mac fleets. No conflicting signals were detected: the local vector matches the 'an app' description. Key missing data: EPSS probability and POC status are absent, so widespread-vs-targeted exploitation cannot be assessed from the input.

A user is tricked into installing or running a malicious or trojanized app on macOS; the app runs with normal user privileges but exploits the improper privilege-management flaw to elevate to a higher privilege level on the system. No separate user interaction is required for the escalation step itself (UI:N), and no public exploit code is known at the time of analysis.