CVE-2026-28924 Overview
CVE-2026-28924 is a race condition vulnerability in Apple macOS that allows an application to access Contacts data without user consent. The flaw stems from improper handling of symbolic links during privacy-sensitive operations. Apple addressed the issue by improving symbolic link handling in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The weakness is categorized under [CWE-362], which covers concurrent execution using shared resources with improper synchronization. The vulnerability impacts data confidentiality but does not affect integrity or availability.
Critical Impact
A malicious application can bypass Transparency, Consent, and Control (TCC) protections to read Contacts data without prompting the user.
Affected Products
- Apple macOS Sequoia versions prior to 15.7.7
- Apple macOS Sonoma versions prior to 14.8.7
- Apple macOS Tahoe versions prior to 26.5
Discovery Timeline
- 2026-05-11 - CVE-2026-28924 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-28924
Vulnerability Analysis
The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition involving symbolic link resolution. Privacy-protected resources on macOS, such as the Contacts database, are guarded by the TCC subsystem. TCC validates path access at one moment and then opens or reads the target file at a later moment. An attacker exploits the gap between these two operations by swapping a benign path component for a symbolic link pointing to a privacy-protected location.
The attack does not require user interaction once the malicious app is running. Because the access decision is made on the resolved path before the swap, the application receives access to data it would otherwise be denied. The result is silent disclosure of Contacts records without a consent prompt.
Root Cause
The root cause is the absence of atomic path validation. The original code performed access checks against a path and later dereferenced the same path, leaving a window during which the path target could be redirected via a symlink. Apple's fix introduces improved handling of symbolic links to close this window and ensure the validated path and the accessed path refer to the same object.
Attack Vector
A local application with no special privileges stages a directory or file it controls, races a TCC-mediated operation, and replaces the target with a symbolic link pointing to the Contacts store. When the privileged or privacy-gated code path completes, the attacker reads the Contacts data through its own file handle. No authentication, user interaction, or elevated privileges are required. The vulnerability falls within the [CWE-362] race condition class.
Detection Methods for CVE-2026-28924
Indicators of Compromise
- Unsigned or unnotarized applications creating symbolic links inside their sandbox container that point to ~/Library/Application Support/AddressBook/ paths.
- Processes performing rapid rename(), symlink(), or link() syscalls against the same path within microseconds of a TCC-mediated open.
- Unexpected reads from AddressBook-v22.abcddb or related Contacts SQLite files by non-Contacts processes.
Detection Strategies
- Monitor endpoint telemetry for processes that call symlink() or symlinkat() targeting paths under the user's Library directory shortly before invoking Contacts APIs.
- Correlate TCC daemon (tccd) authorization events with subsequent file accesses to detect path mismatches.
- Audit installed macOS versions across the fleet to identify hosts running builds older than 15.7.7, 14.8.7, or 26.5.
Monitoring Recommendations
- Enable Endpoint Security framework subscriptions for ES_EVENT_TYPE_NOTIFY_CREATE and ES_EVENT_TYPE_NOTIFY_RENAME events on privacy-sensitive directories.
- Forward macOS Unified Log entries from the com.apple.TCC subsystem to a central SIEM for retroactive review.
- Alert on applications that access Contacts data without an associated TCC consent prompt in the user session history.
How to Mitigate CVE-2026-28924
Immediate Actions Required
- Update affected systems to macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, or macOS Tahoe 26.5 using Software Update or MDM-managed deployment.
- Inventory third-party applications requesting Contacts access and remove any that are unsigned, unnotarized, or unnecessary.
- Review TCC permissions under System Settings → Privacy & Security → Contacts and revoke access for unverified applications.
Patch Information
Apple released fixes in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. Details are available in the Apple Support Advisory 127115, Apple Support Advisory 127116, and Apple Support Advisory 127117. The patches replace the vulnerable path validation logic with symbolic-link-aware checks.
Workarounds
- Restrict installation of applications to those distributed through the Mac App Store or notarized by Apple until patches are deployed.
- Use MDM configuration profiles to enforce Privacy Preferences Policy Control (PPPC) and deny Contacts access to applications that do not require it.
- Monitor for symlink creation in user library directories and quarantine offending binaries pending review.
# Verify the installed macOS build meets the patched version
sw_vers -productVersion
# Trigger software update check via command line
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
