CVE-2026-84535: Apple macOS Sandbox Escape Vulnerability

CVE-2026-84535 Overview

CVE-2026-84535 is an authorization vulnerability in Apple macOS that allows a malicious application to escape the sandbox. Apple addressed the issue with improved state management. The flaw is categorized under [CWE-284] Improper Access Control and affects multiple macOS versions prior to the fixed releases.

A successful exploit permits a local application to bypass sandbox restrictions and access resources outside its intended security boundary. Because sandbox containment is a foundational defense on macOS, escape primitives are commonly chained with other bugs to achieve privilege escalation or persistent compromise.

Critical Impact

An app running under macOS sandbox restrictions can break out of its container and access data or system resources it should not reach, undermining application isolation guarantees.

Affected Products

• Apple macOS Sonoma (prior to Golden Gate 27)
• Apple macOS Sequoia (prior to 15.8)
• Apple macOS Tahoe (prior to 26.7)

Discovery Timeline

• 2026-09-14 - CVE-2026-84535 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84535

Vulnerability Analysis

The vulnerability resides in macOS authorization logic that governs sandboxed process access to protected resources. Apple's advisory attributes the fix to improved state management, indicating that the authorization decision relied on state that could be manipulated or reached in an unexpected sequence.

Sandbox escapes on macOS are impactful because the sandbox enforces mandatory access control on entitled applications, including Mac App Store binaries and browser renderer processes. A reliable escape removes a layer of defense that Apple relies on to constrain untrusted code. Exploitation requires local code execution and user interaction, per the CVSS vector, but the scope is changed and both confidentiality and integrity outside the sandbox are affected.

Root Cause

The underlying defect is an improper access control issue tracked as [CWE-284]. Authorization state was not consistently validated across operations, permitting a sandboxed process to reach a code path where an access decision favored the caller. Apple's remediation hardens the state machine that gates the affected privileged operation.

Attack Vector

An attacker delivers a malicious application to the target, typically through social engineering, a trojanized installer, or a compromised update channel. When the user runs the application, it triggers the vulnerable authorization path from within its sandbox. The application then performs actions outside the sandbox, including reading user files, invoking IPC endpoints, or staging further exploitation. No network access is required and the attack requires local execution with user interaction.

No public proof-of-concept or exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-84535

Indicators of Compromise

• Sandboxed processes spawning child processes or accessing file paths outside their container directory under ~/Library/Containers/.
• Unexpected XPC or Mach message traffic from App Store or bundled applications to privileged system services.
• Application bundles making entitlement or authorization requests inconsistent with their declared Info.plist capabilities.

Detection Strategies

• Monitor sandboxd and TCC (Transparency, Consent, and Control) log entries for repeated denials followed by successful access from the same process.
• Baseline expected IPC endpoints per application and alert on deviations, particularly access to com.apple.* privileged services from third-party sandboxed apps.
• Correlate process ancestry with entitlements to identify sandboxed binaries performing actions typical of unsandboxed processes.

Monitoring Recommendations

• Ingest Endpoint Security framework telemetry covering ES_EVENT_TYPE_NOTIFY_EXEC, file access, and IPC events from macOS endpoints.
• Retain Unified Logging subsystem data for com.apple.sandbox and com.apple.securityd to support post-incident review.
• Track macOS build numbers across the fleet and flag hosts still running versions earlier than macOS 15.8 or 26.7.

How to Mitigate CVE-2026-84535

Immediate Actions Required

• Update all macOS endpoints to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 as applicable to the installed major version.
• Inventory endpoints by macOS build and prioritize systems running unsigned or sideloaded third-party applications.
• Restrict installation of applications outside managed software channels and enforce Gatekeeper policies via Mobile Device Management (MDM).

Patch Information

Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Deployment details are available in Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043.

Workarounds

• Block execution of untrusted applications through MDM configuration profiles enforcing notarization and developer identity checks.
• Limit user accounts to standard privileges to reduce the blast radius of any post-escape actions.
• Educate users to avoid launching applications from unknown sources until patches are deployed across the fleet.

# Verify installed macOS build against fixed versions
sw_vers -productVersion
sw_vers -buildVersion

# Trigger managed software update check (requires admin)
sudo softwareupdate --list
sudo softwareupdate --install --all --restart