A race condition in Apple operating systems allows a malicious application to escape its sandbox, potentially granting it unauthorized access and control over the device. The flaw arises from insufficient validation, enabling the attacker to execute code beyond the app sandbox boundaries. An affected app could read, modify, or delete data on the device or perform actions that normally require higher privileges.

Apple iOS and iPadOS versions prior to 27, and macOS Golden Gate prior to 27 are affected. The issue is fixed in iOS 27, iPadOS 27, and macOS Golden Gate 27.

The EPSS score of 0.00141 and a CVSS score of 7.8 suggest that although exploitation is unlikely, the severity of a sandbox escape is high. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires installation of a malicious app, likely through the App Store or sideloading. Given the ability to escape the sandbox, this flaw can lead to privilege escalation and full system compromise without user interaction beyond installation.