Loading story…
Microsoft disclosed CVE-2022-26706, a macOS App Sandbox escape that allowed specially crafted code to bypass sandbox restrictions and execute unrestricted commands on a host. The flaw was uncovered during research into malicious macro execution in Microsoft Office on macOS, where Word’s ability to read or write files with the ~$ prefix could be chained with macOS Launch Services and the open --stdin option to launch a crafted Python file outside the sandbox. Microsoft reported the issue to Apple in October 2021, and Apple addressed it in security updates released in May 2022.
The vulnerability is significant because Launch Services and related macOS startup mechanisms have repeatedly appeared in real-world malware tradecraft. MITRE ATT&CK documents LaunchAgent persistence under T1543.001, noting widespread abuse of plist files in locations such as ~/Library/LaunchAgents and /Library/LaunchAgents by malware including Bundlore, FruitFly, Proton, ThiefQuest, and CookieMiner. Microsoft said its Defender for Endpoint detections remained effective against multiple Launch Services-based sandbox escape variants, underscoring the defensive value of monitoring for suspicious LaunchAgent creation and unexpected child-process execution from sandboxed applications.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly disclosed technical details of CVE-2022-26706, explaining how a crafted Python file with an "~$" prefix could be executed outside Word's sandbox via open --stdin and Launch Services. The write-up also credited researcher Arsenii Kostromin and noted Defender detections remained effective against related variants.
Apple included a fix for CVE-2022-26706 in security updates released on May 16, 2022. The vulnerability allowed specially crafted code to bypass macOS App Sandbox restrictions and execute unrestricted commands.
In October 2021, Perception Point published a similar macOS sandbox escape later identified as CVE-2021-30864. Its technique used open with the --env option to override HOME so Terminal's zsh would execute a planted .zshenv file from a sandbox container directory.
Microsoft disclosed the macOS App Sandbox escape vulnerability later tracked as CVE-2022-26706 to Apple through coordinated vulnerability disclosure. The report followed Microsoft research into malicious macro execution in Office on macOS.
Several blog posts in 2020 described a generic macOS sandbox escape technique involving the /usr/bin/open utility and Launch Services. These prior techniques informed later research into Office-on-macOS sandbox bypasses.
In 2018, MDSec reported a macOS sandbox escape affecting Office in which Word could write specially named files into sensitive directories such as LaunchAgents. Microsoft later deployed a fix to block writes to LaunchAgents and similar folders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A technical review of **CVE-2018-4340** detailed how a Safari sandbox escape on macOS abused the `MediaRemote` framework and the `com.apple.mediaremoted.xpc` service to trigger the launch of arbitrary installed applications. The researcher said Safari could reach the Mach service and spoof a bundle identifier inside an `MRNowPlayingPlayerPathProtobuf` message, leading `mediaremoted` to invoke LaunchServices and open apps such as Calculator. The write-up said Apple later fully patched the MediaRemote issue after it was publicly presented. The same research also described a separate Safari-reachable XPC service, `com.apple.hiservices-xpcservice`, that allegedly exposed methods capable of rebooting the system, reading arbitrary plist files, and revealing remote files in Finder. The author linked that behavior to an older **macOS Gatekeeper bypass** involving NFS shares, raising the possibility that a remotely hosted application could be registered with LaunchServices and then launched through the MediaRemote path, extending the impact from sandbox escape to potential Gatekeeper circumvention.
Aug 1, 2026
Researchers reported that Apple’s fix for `CVE-2021-30724` in the root-privileged `CVMServer` daemon introduced a new flaw, tracked as `CVE-2022-26721`, that could be reached from the Safari renderer sandbox on macOS. The bug stemmed from uninitialized cleanup metadata left behind when a bounds check aborted processing, creating a path for attacker-controlled `munmap` operations on arbitrary memory pages inside the service. Theori showed the issue could be turned into root code execution by shaping heap contents, using a binary-search-style oracle to infer `CVMServer` memory layout, and overwriting `dyld` private-memory function pointers. A proof of concept reportedly read `/var/db/SystemKey`, which can be used to decrypt macOS keychain files, underscoring the impact of the sandbox escape and privilege-escalation chain. Apple addressed the vulnerability in macOS 12.4 by replacing `malloc` with `calloc` to ensure the descriptor buffer was zero-initialized.
Jul 24, 2026
Apple disclosed two high-severity macOS vulnerabilities, **CVE-2026-28891** and **CVE-2026-28817**, that could allow an application or sandboxed process to escape sandbox restrictions. Both flaws were attributed to race conditions, classified as **CWE-362**, and carried the same `CVSS v3.1` vector: `AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`, indicating local exploitation with potentially severe impact to confidentiality, integrity, and availability. Apple said the issues were remediated through **additional validation** and **improved state handling**. Fixes were released for **macOS Sequoia 15.7.5**, **macOS Sonoma 14.8.5**, and **macOS Tahoe 26.4**, and organizations running affected macOS systems should prioritize those updates because successful exploitation could let untrusted code break out of the sandbox and operate with broader system access.
Jun 29, 2026