Apple M1 GPUs retain register file data between compute shader dispatches from different processes, so a sandboxed Metal attacker can run a GPU reader shader that reads stale register values left by a separate sandboxed victim app. The attacker can recover the exact secret that the victim loaded into the registers, demonstrating a pure information‑disclosure weakness (CWE‑200). No code execution or privilege escalation is described, but the ability to read secrets across app boundaries constitutes a serious confidentiality breach.

The flaw exists only on legacy Apple Silicon GPUs such as the original M1; current‑generation Apple Silicon has already corrected this hardware behavior. It impacts any sandboxed app that uses Metal on those older devices, but not devices beyond the original M1 line.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the exact chance of exploitation is unclear. Nevertheless, the proof‑of‑concept shows that any malicious Metal application on an affected device can recover secrets from other sandboxed apps, indicating a high confidentiality impact. The attack path requires only the presence of a second sandboxed app, making the barrier to exploitation relatively low for users of legacy Apple Silicon that store sensitive data in GPU registers.