Apple macOS EUVD-2026-104699

Exploitation requires local code execution: a malicious or compromised application must already be running on the macOS host (PR:L, AV:L, UI:N), after which it can read sensitive user data it should not be able to access due to the improper access-control flaw. There is no remote or network vector and no user interaction is needed once the app runs. Limiting factors: the attacker must first get an app onto the device and executing, impact is confined to confidentiality (no integrity/availability effect, scope unchanged), and the issue is fully remediated by updating to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 - patched systems are not exploitable.

This is a moderate-severity local information-disclosure flaw (CVSS 5.5) in Apple macOS, and the available signals are consistent in pointing to a low-urgency, non-widespread threat. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires local access and some existing privileges (PR:L) - i.e. a malicious or compromised app already running on the device - so there is no remote or network-facing exposure. EPSS is very low (0.17%, 6th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis; the CISA SSVC framework corroborates this with Exploitation: none, Automatable: no, and Technical Impact: partial. These signals agree rather than conflict: the only notable impact is high confidentiality loss (access to sensitive user data) with no integrity or availability impact. Net assessment: this is a legitimate privacy/access-control fix worth patching in normal cycles, but not an emergency - it is a high-confidentiality-but-local-only issue rather than a high-real-risk remotely exploitable one. One caveat: the input Tag 'Authentication Bypass' is inconsistent with the CWE-284 (improper access control) classification and the description, which describe a permission/access-control bypass by an already-running app, not a bypass of user authentication - treat the tag with caution.

A user installs or is tricked into running a malicious or over-privileged app on macOS. Because of insufficient access controls, that app reads sensitive user data it should not be entitled to, without triggering the expected permission boundary. No public exploit code was identified, and exploitation requires the attacker's code to already be executing locally on the victim system.