An access issue in Apple macOS allows an application to read sensitive user data because the sandbox restrictions are inadequate. The vulnerability is caused by an improper access‑control flaw (CWE-284). The defect permits a potentially malicious or compromised app to bypass expected isolation boundaries and access protected information, resulting in accidental disclosure of private data. The issue is a classic information‑exposure flaw that can compromise user confidentiality.

Apple macOS systems running versions before macOS Tahoe 26.6 are affected, as the fix is incorporated in that release. Any system that has not applied the 26.6 update remains vulnerable to the sandbox bypass.

The CVSS score of 5.5 and an EPSS score of less than 1% indicate a moderate severity and a very low but non‑zero likelihood of exploitation. The vulnerability's impact is the accidental disclosure of private user data; although the exploitation probability is low, the potential confidentiality compromise warrants attention. The attack vector appears to be local, requiring the attacker to run a misbehaving or malicious application that exploits the sandbox defect; an untrusted third‑party app bundled with user content could trigger it. The vulnerability is not listed in CISA KEV, indicating no known large‑scale exploitation at the time of reporting.