Loading vulnerability…
Sandbox Restriction Bypass in macOS Printing
CVE-2026-28817 is a race condition vulnerability in the macOS Printing component. The flaw was addressed through improved state handling. Successful exploitation could allow a sandboxed process to circumvent sandbox restrictions, resulting in a sandbox escape from the intended confinement boundary. Apple released fixes for this issue in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful attacker can cause a sandboxed process to bypass macOS sandbox restrictions. This can expand the process's access beyond its intended isolation boundary and potentially enable access to resources or operations that should be blocked by the sandbox. The published CVSS v3.1 vector indicates high potential impact to confidentiality, integrity, and availability despite local attack requirements and high attack complexity.
If you can’t patch tonight, do this now.
Apply the vendor security updates as soon as possible. Until patching is completed, reduce exposure by limiting execution of untrusted local code, restricting the ability of untrusted applications to run in sandboxed contexts where escape would be security-relevant, and enforcing least-privilege controls on local user access. No specific workaround short of installing the vendor fix is currently available from the provided information.
Patch, then assume compromise.
Upgrade affected systems to a fixed release: macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4, as appropriate for the deployed platform. The vendor fix addresses the race condition through improved state handling in the affected Printing component.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.