Apple macOS EUVD-2026-77876

Requires a malicious application to already be present and executing on the target Mac - the flaw is a sandbox/authorization escape used by a running app, not a remote network exploit. Exploitation is limited by the need to first deliver and get the user to run the untrusted app (social engineering or a compromised installer), and by affected versions being macOS prior to Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7; patched systems are not exploitable. Impact is confined to disclosure of user-sensitive data with no integrity or availability effect.

This is a moderate, not urgent, priority. The vendor CVSS of 7.5 is inflated by a questionable AV:N (network) rating: the description ('An app may be able to access user-sensitive data', addressed via 'additional sandbox restrictions') clearly describes a locally installed/running application escaping its sandbox, not a remote network attack - attack vector should realistically be AV:L, dropping the true score to roughly 4.7 and confidentiality-only. All exploitation signals point low: EPSS is 0.19% (9th percentile), there is no CISA KEV listing and no public POC identified, so this is no public exploit identified at time of analysis. No SSVC decision data was provided. The impact is confidentiality-only (C:H/I:N/A:N) - read access to user-sensitive data, not code execution or account takeover. Net: a real but low-to-moderate local privacy/sandbox flaw that is already patched; prioritize via normal macOS update cadence rather than emergency response. Verify the attack vector with Apple - the CVSS network rating contradicts the sandbox-escape description.

A user is tricked into installing and running a malicious or trojanized application from outside the Mac App Store. Once running, the app abuses insufficient sandbox restrictions to reach user-sensitive data (files, personal information) it should not have authorization to access. No public exploit code is known, and the flaw yields data disclosure only, not code execution.