An authorization flaw was discovered in macOS state management, enabling a malicious application to escape its sandbox. The vulnerability arises from improper handling of authorization state, allowing code to execute outside of the sandbox boundaries and potentially gain full system access. This represents a high-impact access control weakness, classified under CWE-284.

Apple’s macOS operating system is affected, specifically versions prior to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The issue is fixed in those releases.

The EPSS score is below 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw can break sandbox isolation, its impact remains high. Exploitation requires a malicious application to be executed on the target machine, suggesting a local attack vector that could advance from sandbox constraints to full system compromise. Until the relevant updates are installed, the risk is considered high for any user who may run untrusted applications.