CVE-2026-28922: Apple macOS Information Disclosure Flaw

CVE-2026-28922 Overview

CVE-2026-28922 is an information disclosure vulnerability in Apple macOS caused by improper state management. A malicious application can exploit this flaw to access private information that should remain protected by operating system boundaries. The issue affects multiple macOS releases and has been resolved in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The vulnerability is categorized under [CWE-200] Information Exposure and requires user interaction to trigger an attack chain that leads to data disclosure.

Critical Impact

A malicious app installed on a vulnerable macOS system can read private user information due to improper state management within affected components.

Affected Products

• Apple macOS Sequoia (versions prior to 15.7.7)
• Apple macOS Sonoma (versions prior to 14.8.7)
• Apple macOS Tahoe (versions prior to 26.5)

Discovery Timeline

• 2026-05-11 - CVE-2026-28922 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28922

Vulnerability Analysis

The vulnerability stems from improper state management within an affected macOS component. State management errors occur when application logic fails to validate or synchronize internal state across operations. An attacker leveraging this flaw can manipulate component state to expose private information that should remain isolated from unprivileged applications.

Apple categorizes the impact as an app being able to access private information. The flaw aligns with [CWE-200] Information Exposure, where sensitive data crosses a trust boundary unintentionally. Exploitation requires the attacker to deliver a malicious application to the target and convince the user to execute it.

The issue affects all three currently supported macOS train releases, indicating the defective code path exists in a shared subsystem. Apple resolved the flaw by improving state management within the affected component, but the company has not published implementation-level technical detail in its advisories.

Root Cause

The root cause is improper state management. State management defects allow application logic to operate on stale, partial, or attacker-influenced state, exposing data that the operating system should otherwise protect.

Attack Vector

An attacker must deliver a malicious application to the target system. Once executed by the user, the application interacts with the vulnerable component to extract private information. Although the CVSS vector identifies a network attack vector, the practical delivery mechanism is a malicious application that the user runs, satisfying the user interaction requirement.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Apple Support Advisory #127115, Apple Support Advisory #127116, and Apple Support Advisory #127117 for vendor guidance.

Detection Methods for CVE-2026-28922

Indicators of Compromise

• No public indicators of compromise have been published by Apple or third-party researchers for this CVE.
• Unsigned or recently installed applications that request access to user data directories without a clear business purpose warrant investigation.

Detection Strategies

• Inventory macOS endpoints and identify hosts running versions earlier than macOS Sequoia 15.7.7, Sonoma 14.8.7, or Tahoe 26.5.
• Monitor application installations from outside the App Store and review newly executed binaries with Gatekeeper logs.
• Correlate process execution telemetry with file access to user library paths such as ~/Library/Application Support/ and ~/Library/Containers/.

Monitoring Recommendations

• Collect Endpoint Security framework events for process execution, file open, and entitlement use across macOS fleets.
• Alert on applications reading sensitive containers belonging to other applications or system services.
• Track macOS version distribution in your asset management platform and flag systems pending the May 2026 security updates.

How to Mitigate CVE-2026-28922

Immediate Actions Required

• Apply the May 2026 Apple security updates to bring affected systems to macOS Sequoia 15.7.7, Sonoma 14.8.7, or Tahoe 26.5.
• Restrict installation of unsigned or unnotarized applications through configuration profiles and Gatekeeper enforcement.
• Audit applications with Full Disk Access and remove entitlements that are not required for business operations.

Patch Information

Apple addressed CVE-2026-28922 through improved state management in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. Patch details are published in Apple Support Advisory #127115, Apple Support Advisory #127116, and Apple Support Advisory #127117.

Workarounds

• No vendor-supplied workaround exists; patching is the only complete remediation.
• Enforce least-privilege application policies and block execution of unapproved applications using mobile device management (MDM) tooling.
• Educate users to avoid running applications from untrusted sources until the security update is deployed.

# Verify the installed macOS version and confirm patch level
sw_vers -productVersion

# Trigger Apple software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart