Apple OS Sandbox Escape via Permission Issue before 15.7.4
CVE-2026-20628 Published on February 11, 2026

A permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to break out of its sandbox.

NVD

Vulnerability Analysis

CVE-2026-20628 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2026-20628 has been classified to as an Authorization vulnerability or weakness.


Products Associated with CVE-2026-20628

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-20628 are published in these products:

 
 
 
 
 
 
 
 

Affected Versions

Apple macOS: Apple watchOS: Apple visionOS: Apple macOS: Apple macOS: Apple iOS and iPadOS: Apple iOS and iPadOS: Apple tvOS:

Exploit Probability

EPSS
0.01%
Percentile
1.05%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.