EUVD-2026-78108
GHSA-vmcr-vvm6-5x2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious sandboxed app to victim
-
DeliveryApp runs with normal sandbox confinement
-
ExploitInvoke flawed check to escape sandbox (S:C)
-
ExecutionAccess host resources outside container
-
ImpactRead/modify data beyond sandbox scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have local code execution as an application running inside the macOS App Sandbox (PR:L, AV:L) - for example, a malicious or compromised sandboxed app the user has installed and launched. No user interaction beyond running the app is needed (UI:N). Exploitation is limited to unpatched macOS versions below Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; it is not remotely reachable and does not by itself provide initial access, functioning instead as a boundary-crossing primitive after code is already running on the host. |
| Impact | This is a genuinely serious local privilege/isolation flaw despite modest exploitation-probability signals. The CVSS 8.4 is driven by a scope change (S:C) with high confidentiality and integrity impact - consistent with a sandbox escape where a constrained app crosses a security boundary into the host OS. The vector is local (AV:L), low-complexity (AC:L), and requires low privileges (PR:L, i.e. code already running as a sandboxed/low-privilege app) with no user interaction. EPSS is low at 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit was identified, so this is not evidence of active or imminent mass exploitation. However, EPSS/KEV signals are weak predictors for Apple bugs reported and fixed internally by the vendor: sandbox escapes are prized as chain links in real-world macOS exploit chains (typically paired with an initial-access RCE and a later kernel LPE), so the practical priority for patching is higher than the raw probability metrics suggest. Net: real priority for any macOS fleet, but as a post-compromise/chaining primitive rather than a standalone remote entry point. Note the vector metrics (AV:L, PR:L) align well with the 'An app may be able to break out of its sandbox' description - no conflict between CVSS and description here. |
| Exploit ScenarioDerived | A user is convinced to install or run a malicious or trojanized app that is normally confined by the macOS App Sandbox. On execution the app exploits the missing-authorization flaw to break out of its sandbox, gaining access to files and resources outside its container and undermining OS-level isolation. No public exploit code was identified, and exploitation requires local code execution as the sandboxed app first. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Sandbox escape in Apple macOS lets a malicious or compromised application already running inside the macOS App Sandbox break out of that confinement and operate with privileges beyond what its sandbox profile permits (CVSS 3.1 base 8.4, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Affected systems are macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27; exploitation requires the attacker to already have local code execution as a sandboxed app (for example, one the user installed and launched), and provides no remote initial access, functioning as a boundary-crossing primitive once code is running on the host. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.19% (9th percentile), so real-world activity appears limited, though the sandbox-boundary impact keeps this a serious local isolation flaw rather than a theoretical one.
RemediationAI
Vendor-released patch: macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27 fix CVE-2026-84580 - upgrade to or beyond the fixed build for whichever branch each host runs, using the Apple advisories at https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043 to map builds to releases. No public exploit has been identified (EPSS 0.19%, 9th percentile) and the flaw is not in CISA KEV, so patching can follow normal maintenance cadence rather than emergency change control. Where an immediate upgrade is not feasible, the exposure is driven by untrusted sandboxed code running on the host, so force app installation only from managed sources, keep Gatekeeper and notarization enforcement enabled, and use MDM to inventory and, if necessary, remove unvetted or sideloaded applications - the trade-off is reduced user flexibility and potential business disruption for line-of-business apps that do not ship through managed channels. Because the vector is AV:L/PR:L with no network component, firewall, network segmentation, and perimeter controls provide no mitigation, and user-level workarounds cannot reliably re-impose a sandbox boundary the OS failed to enforce; do not attempt to disable or weaken App Sandbox entitlements as a workaround, since that broadens rather than narrows exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is the macOS App Sandbox, the entitlement- and profile-driven containment layer that restricts what a signed application can access - file system locations, network sockets, IPC endpoints, and system services - so that a compromised app cannot pivot into the rest of the operating system. The root cause class is CWE-862 (Missing Authorization): a check that should have prevented a sandboxed process from performing an action was either absent or insufficient, and Apple's own description states the issue was addressed with improved checks. The CVSS vector's scope change (S:C) is the key technical signal - the vulnerability does not merely affect the sandboxed process's own security authority but crosses a trust boundary into the host, with High confidentiality and integrity impact and no availability impact. AV:L combined with PR:L and UI:N confirms the attacker must already be executing code locally as a sandboxed app but needs no further user interaction. CPE data (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) covers the macOS line generally, and ENISA EUVD version ranges (macOS 0 <15.8, <26.7, <27) confirm the flaw spans all three supported branches before their respective fixed builds.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Local sandboxed app already running gives AV:L/PR:L; escaping the sandbox crosses a trust boundary (S:C) exposing host data (C:H/I:H) with no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox.
Executive ViewAI
Apple macOS releases prior to Sequoia 15.8, Tahoe 26.7, and Golden Gate 27 contain a sandbox escape that allows code already running inside the macOS App Sandbox to break out and act with privileges its profile was never meant to grant. Because it requires a user to first install or launch a malicious application, the exposure is concentrated on managed Macs where employees routinely run third-party or untrusted software; successful abuse lets an attacker with only a foothold extend reach across the host, weakening the isolation control security teams rely on to contain compromises. While no public exploit has been identified and real-world activity appears limited, the integrity and confidentiality consequences of a boundary breach keep this a materially serious local isolation flaw for leadership to track.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB