Executive brief
macOS uses app sandboxing to restrict what individual applications can access on a system, protecting user data and system integrity. A vulnerability in symlink handling allowed malicious apps to break out of this sandbox, potentially gaining access to files and resources outside their intended scope. This was patched in macOS Golden Gate 27.
Technical details
This vulnerability is a sandbox escape affecting macOS file system handling, specifically in the processing of symbolic links. The root cause is improper validation of symlink paths, allowing an app with local execution capability to traverse restrictions and access resources outside its sandbox boundary. The attack requires local code execution within a sandboxed application context but does not require user interaction beyond running a malicious app. Successful exploitation enables an attacker to read arbitrary files, modify protected data, or escalate privileges on the system. The fix, deployed in macOS Golden Gate 27 released 14 September 2026, implements improved symlink path validation and bounds checking.
Affected products
- Apple macOS prior to Golden Gate 27
Timeline
- 2026-09-14: disclosed: Fixed in macOS Golden Gate 27
- 2026-09-14: patched: macOS Golden Gate 27 released