Sandbox escape in macOS Installer

Successful exploitation allows a malicious application to escape its sandbox and operate outside the restrictions normally imposed by the macOS application sandbox. This can expand the app's access to system resources and data beyond its intended entitlement boundary, undermining platform isolation and enabling follow-on actions such as unauthorized access to protected resources or chaining with additional local vulnerabilities.

Apply the vendor security updates as soon as possible. Until patching is completed, reduce exposure by limiting installation and execution of untrusted or low-trust applications, enforcing application allowlisting where available, and restricting local code execution to trusted software sources. Additional hardening of endpoint controls around application execution may reduce the likelihood of exploitation, but no complete mitigation short of installing the fix is currently available from the provided information.

Upgrade affected systems to a fixed release: macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, or macOS Tahoe 26.5, as applicable. Apple states the issue was corrected by imposing additional restrictions in the affected component.