Executive brief
A security vulnerability in macOS Tahoe could allow a malicious application to bypass privacy protections and access sensitive user data. This could lead to the unauthorized exposure of personal information or files that are normally protected by the operating system's security framework. Users should update to macOS Tahoe 26.5 to resolve this issue.
Technical details
A permissions vulnerability exists in macOS Tahoe due to insufficient restrictions on how applications interact with protected data. An attacker can exploit this by tricking a user into running a malicious application, which can then bypass Privacy preferences to access sensitive user information. The root cause is a logic flaw in the permissions enforcement mechanism. Apple addressed this issue in macOS Tahoe 26.5 by implementing additional restrictions and improved state management. This vulnerability is tracked as CVE-2026-28930.
Affected products
- Apple macOS Tahoe Before 26.5
Timeline
- 2026-05-11: disclosed
- 2026-05-11: patched: Fixed in macOS Tahoe 26.5