A permissions flaw in macOS allows an application to read a user’s contact list, exposing personal data that may be sensitive. The vulnerability arises from insufficient sandbox enforcement, enabling software to bypass normal authorization controls and access contacts that should be protected. Such exposure can lead to privacy violations, data leakage, and potential social engineering attacks.

Apple macOS, including the identified fix version Golden Gate 27. Any system running earlier releases of macOS Golden Gate may allow an application to read contacts, without restrictions imposed by the later patch.

The CVSS score is 3.3, and the EPSS score is < 1%, which limits precise quantification of exploitation risk. The vulnerability is not listed in CISA KEV, suggesting no confirmed public exploits at the time of this analysis. However, the potential impact on confidentiality and the straightforward nature of the exploit path mean that the risk remains significant if the system remains on an affected version.