Loading story…
Apple disclosed two high-severity macOS vulnerabilities, CVE-2026-28891 and CVE-2026-28817, that could allow an application or sandboxed process to escape sandbox restrictions. Both flaws were attributed to race conditions, classified as CWE-362, and carried the same CVSS v3.1 vector: AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating local exploitation with potentially severe impact to confidentiality, integrity, and availability.
Apple said the issues were remediated through additional validation and improved state handling. Fixes were released for macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4, and organizations running affected macOS systems should prioritize those updates because successful exploitation could let untrusted code break out of the sandbox and operate with broader system access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE entries were later updated to add CWE-362 classification and CVSS v3.1 scoring information, including the vector AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The updates characterized the bugs as local, high-impact vulnerabilities affecting confidentiality, integrity, and availability.
Apple said the vulnerabilities were addressed with improved state handling and additional validation in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. These updates were identified as the fixes for the disclosed sandbox escape issues.
Apple disclosed CVE-2026-28817 and CVE-2026-28891, both race condition flaws that could allow a sandboxed app or process to escape sandbox restrictions on macOS. The CVE records were received from Apple's product security team and published on the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates for **macOS Sequoia 15.7.5** and **macOS Sonoma 14.8.5**, patching a wide range of vulnerabilities across core operating system components, networking, printing, privacy controls, the kernel, and bundled open-source software. The advisories describe flaws that could lead to **privilege escalation**, **sandbox escape**, **unauthorized access to sensitive data**, **kernel memory disclosure**, **denial of service**, **arbitrary file write**, and modification of protected file system areas. Affected components include high-risk areas such as **Kernel**, **CoreServices**, **CUPS**, **CFNetwork**, **NetAuth**, **SMB**, **TCC**, **Security**, and **PackageKit**, with additional privacy-related fixes for apps and services including **Mail**, **Messages**, **Focus**, **Phone**, and **Spotlight**. Apple also shipped patches for third-party code in **Apache**, **curl**, and ImageIO-related libraries, and credited external researchers and organizations including **KU Leuven**, **Google**, **Trend Micro Zero Day Initiative**, **Nosebeard Labs**, **DBAppSecurity WeBin lab**, and Renault researchers for reporting the issues.
Jun 29, 2026
Apple released **Safari 26.4** and **Xcode 26.4** security updates to address multiple vulnerabilities affecting macOS systems. The Safari update for **macOS Sonoma** and **macOS Sequoia** fixes seven `CVE`-tracked issues in **WebKit** and **WebKit Sandboxing** that could enable **Content Security Policy** and **Same Origin Policy** bypasses, **cross-site scripting**, process crashes, cross-origin access to script message handlers, improper processing of restricted web content, and user fingerprinting. Apple said the flaws were mitigated through improved state management, input validation, logic checks, memory handling, and authorization controls. The **Xcode 26.4** advisory covers two vulnerabilities on systems running **macOS Tahoe 26.2 and later**. Apple patched an out-of-bounds read in `otool` (`CVE-2026-28890`) that could let an app trigger an unexpected system termination, and a permissions flaw in **Simulator** (`CVE-2026-28889`) that could allow an app to read arbitrary files as **root**. Apple credited external researchers for the findings and made the updates available through the **Mac App Store**, developer download channels, and its security releases pages.
Jun 29, 2026
Apple released a wide-ranging set of security updates across **iOS**, **iPadOS**, **macOS Tahoe**, **watchOS**, **tvOS**, **visionOS**, **Safari**, and **Xcode**, addressing more than 85 vulnerabilities across core components including the kernel, WebKit, AirPlay, Keychain, and open-source libraries. The updates fix issues that could enable traffic interception, kernel state disclosure, user fingerprinting, installed-app enumeration, Mail privacy bypasses, exposure of deleted Notes content, and crashes from out-of-bounds writes. Apple said it had no reports of in-the-wild exploitation for the vulnerabilities listed in the release notes, but urged users to update, with particular importance for older devices and managed macOS environments. Among the patched flaws is **`CVE-2024-27828`**, a high-severity memory-handling bug in **IOSurfaceRoot** that could let a local app trigger a kernel panic or execute arbitrary code with kernel privileges. STAR Labs said the issue stemmed from a reference count leak in `IOSurfaceRootUserClient::s_create_shared_event`, where repeated calls with crafted input could corrupt memory handling; the flaw affected iOS and iPadOS before 17.5, tvOS before 17.5, watchOS before 10.5, and visionOS before 1.2. Apple addressed the bug through improved memory handling, adding it to a broader pattern of fixes spanning both current and legacy Apple platforms.
Jul 1, 2026