A sandboxed process can bypass macOS permissions and launch any installed application, effectively giving an attacker the ability to execute arbitrary code within the context of the launched app. The vulnerability stems from an improper authorization flaw (CWE-274) that allows a process confined by a sandbox to perform operations it should not be able to, leading to potential compromise of system integrity and confidentiality.

MacOS for all versions before macOS Sequoia 15.6 are affected. The issue is fixed in macOS Sequoia 15.6 and later releases. Users running earlier releases are at risk.

The CVSS score of 6.2 indicates a medium severity flaw. The EPSS score of less than 1% suggests exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a sandboxed process, potentially legitimate or malicious, that can be leveraged to launch arbitrary applications. The lack of widely-deployed zero‑day exploits combined with the low EPSS score mitigates urgency, but the impact of being able to run any app warrants prompt attention.