CVE-2026-28978: Apple macOS Privilege Escalation Flaw

CVE-2026-28978 Overview

CVE-2026-28978 is a permissions vulnerability in Apple macOS that allows a malicious application to escape its sandbox. The flaw stems from insufficient access controls [CWE-284] within affected macOS releases. Apple addressed the issue by adding restrictions in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.

Local exploitation requires low privileges and no user interaction. A successful attacker gains the ability to operate outside the sandbox boundary, with scope change extending impact to resources beyond the original process context.

Critical Impact

A malicious application can break out of the macOS sandbox and access resources that should be isolated, compromising confidentiality, integrity, and availability of the host system.

Affected Products

• Apple macOS Sequoia versions prior to 15.7.7
• Apple macOS Sonoma versions prior to 14.8.7
• Apple macOS Tahoe versions prior to 26.5

Discovery Timeline

• 2026-05-11 - CVE-2026-28978 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28978

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. macOS enforces sandbox boundaries to restrict what applications can read, write, or execute outside their entitled scope. A permissions issue in the affected releases allowed a sandboxed process to perform actions outside its intended container.

Apple's advisory states the fix introduces additional restrictions, indicating the prior implementation granted broader permissions than intended. The scope is marked as changed, meaning the exploited component grants access to resources managed by a separate security authority. The result is full compromise of confidentiality, integrity, and availability for affected resources.

Root Cause

The root cause is improper permission enforcement within a macOS component accessible to sandboxed apps. The original logic did not sufficiently restrict the operations a confined process could request. Apple's remediation tightens those checks, preventing the sandboxed process from reaching resources outside its entitled boundary.

Attack Vector

Exploitation requires local access through a malicious app already running on the system with low-privilege user context. No user interaction is required after the app executes. An attacker would deliver a crafted application through standard distribution paths such as a downloaded installer, a side-loaded binary, or a compromised legitimate app. Once running inside its sandbox, the app triggers the permissions flaw to access files, IPC endpoints, or system services outside its allowed scope. Technical specifics on the exploited component are not disclosed in Apple's advisories. Refer to Apple Support Document #127115, Apple Support Document #127116, and Apple Support Document #127117 for vendor details.

Detection Methods for CVE-2026-28978

Indicators of Compromise

• Sandboxed applications spawning child processes or accessing files outside their container directory under ~/Library/Containers/
• Unexpected xpc or Mach IPC connections from App Store or sandboxed binaries to privileged system services
• Modifications to user data, keychain items, or preferences originating from applications that should be sandbox-restricted

Detection Strategies

• Monitor Endpoint Security framework events (ES_EVENT_TYPE_NOTIFY_OPEN, ES_EVENT_TYPE_NOTIFY_EXEC) for sandboxed processes touching paths outside their container
• Correlate process code signature entitlements with observed filesystem and network behavior to surface activity inconsistent with declared sandbox scope
• Audit Unified Logs for sandbox subsystem deny or anomaly entries that precede successful access to protected resources

Monitoring Recommendations

• Track installed macOS versions across the fleet and flag endpoints running builds older than 15.7.7, 14.8.7, or 26.5
• Inventory third-party applications with sandbox entitlements and prioritize review of those running with broad temporary exceptions
• Alert on privilege transitions or TCC database modifications associated with non-system signed processes

How to Mitigate CVE-2026-28978

Immediate Actions Required

• Update affected systems to macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, or macOS Tahoe 26.5 immediately
• Restrict installation of applications to those from the App Store or identified developers via Gatekeeper policy
• Review recently installed applications on managed endpoints for unsigned or unexpected binaries

Patch Information

Apple released fixes in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. Patch details are published in Apple Support Document #127115, Apple Support Document #127116, and Apple Support Document #127117. Deploy these updates through MDM, Software Update, or softwareupdate for command-line driven environments.

Workarounds

• No vendor-supplied workaround exists; patching is the only supported remediation
• Limit local execution privileges and enforce application allow-listing to reduce the chance of a malicious sandboxed app running
• Enable system integrity protections and disable installation of unsigned applications until updates are applied

# Verify macOS version and trigger update where applicable
sw_vers -productVersion
sudo softwareupdate --install --all --restart