CVE-2026-86933: macOS Golden Gate Contact Info Disclosure

CVE-2026-86933 Overview

CVE-2026-86933 is a permissions issue in macOS that allows an application to access information about a user's contacts. Apple addressed the flaw by adding sandbox restrictions in macOS Golden Gate 27. The vulnerability is categorized under [CWE-269] Improper Privilege Management and requires local access with low privileges to exploit. No user interaction is required for an attacker-controlled app to read contact data. The flaw affects confidentiality only; integrity and availability remain unaffected.

Critical Impact
A malicious or compromised app running on macOS can bypass sandbox boundaries to enumerate a user's contacts, exposing personally identifiable information without triggering a consent prompt.

Affected Products

Apple macOS versions prior to Golden Gate 27
Applications relying on the macOS sandbox to isolate contact data
Third-party apps distributed through the Mac App Store and notarized channels

Discovery Timeline

2026-10-20 - CVE-2026-86933 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-86933

Vulnerability Analysis

The vulnerability resides in the macOS sandbox profile that mediates application access to the Contacts framework. An app operating under a sandboxed context can reach contact records that should be gated behind an explicit user authorization prompt. Apple's advisory describes the fix as the addition of further sandbox restrictions, indicating that the prior policy did not fully enforce the intended privacy boundary.

Because the attack vector is local, an attacker must already have the ability to execute code on the system. This typically occurs through a user installing a malicious application or a legitimate application being compromised. The exposure is limited to confidentiality of contact information, with no modification or denial of service impact.

See the Apple Support Document for the vendor description of the fix.

Root Cause

The root cause is an improper privilege management failure [CWE-269] in the sandbox profile covering Contacts access. The policy permitted a code path that returned contact information without validating the caller's TCC (Transparency, Consent, and Control) authorization. Golden Gate 27 tightens the profile so that unauthorized access is denied at the sandbox layer.

Attack Vector

An attacker delivers an application to the target system through standard distribution channels or by compromising an installed app. When executed, the app invokes the vulnerable API path and retrieves contact records without a user prompt. No elevated privileges beyond standard user context are required, and no user interaction occurs during the data access itself.

No verified public exploit code is available. Refer to the Apple advisory for implementation details.

Detection Methods for CVE-2026-86933

Indicators of Compromise

Unexpected process reads against ~/Library/Application Support/AddressBook/ or Contacts/ directories by non-Contacts applications
Sandboxed applications issuing XPC calls to com.apple.AddressBook services without a corresponding TCC prompt
Outbound network transfers correlated with newly installed or recently updated third-party apps that reference contact field names such as givenName, familyName, or emailAddresses

Detection Strategies

Monitor Endpoint Security framework events for file access on contact database paths by processes outside the expected allowlist
Baseline TCC prompt activity per application and alert when contact data is accessed without a prior authorization event
Review Mobile Device Management (MDM) telemetry for apps requesting Contacts entitlements that do not align with their stated function

Monitoring Recommendations

Collect tccd and sandboxd log events into a centralized SIEM for cross-host correlation
Alert on process executions that touch AddressBook SQLite stores from unsigned or non-notarized binaries
Track application install and update events on managed macOS fleets to identify newly introduced software that could leverage the flaw

How to Mitigate CVE-2026-86933

Immediate Actions Required

Upgrade affected endpoints to macOS Golden Gate 27 or later
Audit installed applications and remove software from untrusted developers
Review Privacy & Security settings and revoke Contacts access for apps that do not require it

Patch Information

Apple fixed the issue in macOS Golden Gate 27 by adding sandbox restrictions that prevent unauthorized access to Contacts data. Deploy the update through Software Update, MDM profiles, or Apple Business Manager. Full details are available in the Apple Support Document.

Workarounds

Restrict installation of third-party applications to vetted, notarized sources until patching is complete
Enforce an application allowlist through MDM to block execution of untrusted binaries
Educate users to deny Contacts access prompts for applications that do not require address book functionality

bash

# Verify the installed macOS build on managed endpoints
sw_vers -productVersion
sw_vers -buildVersion

# List applications that currently hold Contacts (AddressBook) authorization
sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT client, auth_value FROM access WHERE service='kTCCServiceAddressBook';"