Executive brief
A security vulnerability in macOS could allow a malicious application to access sensitive user data. This issue is caused by a race condition, which is a timing error in how the operating system handles internal states. If exploited, an attacker could bypass certain privacy protections to steal personal information.
Technical details
A race condition vulnerability exists in macOS Sequoia, Sonoma, and Tahoe due to improper state handling. A local malicious application could exploit this timing flaw to bypass security restrictions and gain unauthorized access to sensitive user data. The vulnerability was mitigated by improving state management within the affected components. Apple has released patches in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.
Affected products
- Apple macOS Sequoia Before 15.7.8
- Apple macOS Sonoma Before 14.8.8
- Apple macOS Tahoe Before 26.6
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory