Loading vulnerability…
Sandbox Escape in Apple NetAuth
CVE-2026-28891 is a sandbox escape vulnerability in Apple NetAuth affecting macOS. The flaw is described as a race condition that was addressed with additional validation. Successful exploitation may allow a local application to break out of the macOS app sandbox and operate outside the restrictions normally enforced on sandboxed processes. Apple fixed the issue in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful exploit can allow a local application to escape its sandbox, crossing an intended security boundary. This can expose confidentiality, integrity, and availability to further compromise by enabling access to resources or capabilities that should be denied to the sandboxed app, and may facilitate follow-on actions beyond the app’s original confinement.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting execution of untrusted or low-trust local applications, enforcing application allowlisting, and maintaining least-privilege controls around software installation and execution. Because this is a local sandbox escape, prioritizing rapid deployment of the vendor update is the primary mitigation.
Patch, then assume compromise.
Apply Apple's fixes by upgrading affected systems to macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4, or later vendor-supplied releases that include the patch. The issue was addressed by additional validation in the affected component.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.