Apple macOS CVE-2026-84580

Requires the attacker to already have local code execution as an application running inside the macOS App Sandbox (PR:L, AV:L) - for example, a malicious or compromised sandboxed app the user has installed and launched. No user interaction beyond running the app is needed (UI:N). Exploitation is limited to unpatched macOS versions below Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; it is not remotely reachable and does not by itself provide initial access, functioning instead as a boundary-crossing primitive after code is already running on the host.

This is a genuinely serious local privilege/isolation flaw despite modest exploitation-probability signals. The CVSS 8.4 is driven by a scope change (S:C) with high confidentiality and integrity impact - consistent with a sandbox escape where a constrained app crosses a security boundary into the host OS. The vector is local (AV:L), low-complexity (AC:L), and requires low privileges (PR:L, i.e. code already running as a sandboxed/low-privilege app) with no user interaction. EPSS is low at 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit was identified, so this is not evidence of active or imminent mass exploitation. However, EPSS/KEV signals are weak predictors for Apple bugs reported and fixed internally by the vendor: sandbox escapes are prized as chain links in real-world macOS exploit chains (typically paired with an initial-access RCE and a later kernel LPE), so the practical priority for patching is higher than the raw probability metrics suggest. Net: real priority for any macOS fleet, but as a post-compromise/chaining primitive rather than a standalone remote entry point. Note the vector metrics (AV:L, PR:L) align well with the 'An app may be able to break out of its sandbox' description - no conflict between CVSS and description here.

A user is convinced to install or run a malicious or trojanized app that is normally confined by the macOS App Sandbox. On execution the app exploits the missing-authorization flaw to break out of its sandbox, gaining access to files and resources outside its container and undermining OS-level isolation. No public exploit code was identified, and exploitation requires local code execution as the sandboxed app first.