A sandboxed process may bypass macOS sandbox restrictions, enabling it to access resources it should be denied. This permission issue effectively allows an attacker with ability to run a sandboxed application to elevate privileges and potentially read or modify files, execute unauthorized processes, or otherwise compromise application isolation. The weakness is an instance of insufficient authorization as reflected by CWE‑693.

Apple macOS systems, specifically the Sequoia and Sonoma releases before the specified update levels—Sequoia 15.6 and Sonoma 14.8—are impacted. Any installation of these operating systems lacking the security update that introduces stricter sandbox controls is vulnerable. The issue has not been assigned to a particular pre‑release, so all earlier versions of these OS families remain at risk until patched.

The CVSS score of 9.1 signifies a high‑severity vulnerability. However, the EPSS indicates an exploitation probability of less than 1 percent, suggesting that the exploitation window is currently narrow. This vulnerability is not listed in the CISA KEV catalog, and therefore no confirmed exploits are publicly documented. The likely attack vector is through a malicious sandboxed application that can escape its restrictions, implying that local or remote execution of such an app could lead to privilege escalation.