A privacy flaw in macOS allows an application to leak sensitive user information. The vulnerability was fixed by removing or protecting the sensitive data that could be accessed by an app. The flaw can expose private data, potentially impacting user confidentiality if an attacker can cause the application to reveal such information.

Vulnerable macOS releases include Apple macOS versions prior to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The bug was addressed in the indicated patch releases for each platform.

The CVSS score of 5.5 indicates moderate impact with potential for information disclosure, while the EPSS score of < 1% indicates a very low probability of exploitation. Attackers would need a malicious or compromised application that can access the exposed sensitive data; the exact attack vector is not detailed but is inferred to require the app to execute code that triggers the leak. The flaw is not listed in CISA’s KEV catalog, so there are no known large‑scale exploitation reports. The weakness is identified as CWE-200.