Apple macOS CVE-2026-65379

Exploitation requires an attacker-controlled app to already be installed and executing locally on the Mac (AV:L, PR:L) - there is no remote or network-based path. The flaw concerns macOS 'secure input state' handling, so the realistic trigger is a malicious or trojanized application reading protected user input/data it should be isolated from. Limiting factors: the attacker must first achieve local code execution via a running app with at least low-level user privileges; no privilege escalation or data modification is possible (I:N/A:N), only confidentiality is affected (C:H); and systems updated to macOS Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 are not vulnerable.

This is a moderate-severity local information disclosure flaw (CVSS 5.5, CWE-200) whose signals are internally consistent and point to LOW real-world urgency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a locally-resident, low-privileged app that can read sensitive user data but cannot modify data or affect availability - there is no remote network vector. This aligns with the description ('An app may be able to access sensitive user data'), which implies attacker code must already be running on the device. The CISA SSVC framework reinforces low priority: Exploitation=none, Automatable=no, Technical Impact=partial. EPSS is very low at 0.17% (6th percentile), the CVE is NOT on the CISA KEV list, and no public exploit was identified. All signals agree, so there is no conflict to flag: this is a legitimately-patched defense-in-depth fix (secure input state handling) rather than an actively-exploited priority. The main caveat is that the confidentiality impact is rated High (C:H), so for high-value endpoints handling secrets it warrants timely patching, but it is not an emergency.

A user is tricked into installing or running a malicious or compromised application on a vulnerable Mac. Because the app runs locally with ordinary user privileges, it leverages the secure-input-state handling flaw to read sensitive user data (such as credentials or input intended to be protected) that it should not be able to access. No public exploit code has been identified, and the attack requires the attacker to already have local code execution on the device.