CVE-2025-43339: macOS Tahoe Sandbox Access Control Bypass Allows User Data Disclosure

Technical summary

CVE-2025-43339 is an access control failure (CWE-284) in the macOS sandbox architecture. The vulnerability permits a locally-running malicious application to circumvent sandbox boundaries and access protected user data. The attack requires the app to already be executing on the system with user-level privileges; no elevation or interaction is needed to trigger the breach once the malicious app is present. The fix involves tightening sandbox restriction rules to prevent this data access path.

Business impact

For macOS users, this creates risk of unauthorized disclosure of personal information—potentially including documents, browsing history, authentication tokens, or other data stored in protected directories. Organizations deploying managed macOS fleets should treat this as a user-data confidentiality threat. The risk is elevated for users who install untrusted third-party applications, as such apps could exfiltrate sensitive information without the user's knowledge. However, the attack does not enable persistence, privilege escalation, or system compromise beyond data theft.

Affected systems

macOS Tahoe versions prior to 26.1. This vulnerability affects users running any earlier version of macOS Tahoe on Intel and Apple Silicon Macs.

Exploitability

Exploitability is local-only and requires a malicious app to already be running on the target system. There is no network attack surface, no requirement for user interaction beyond app installation, and no special privileges needed beyond standard user-level execution. The barrier to exploitation is primarily distribution and installation of the malicious app itself. Once running, the data access occurs without additional user prompts.

Remediation

Install macOS Tahoe 26.1 or later. This is a critical maintenance update and should be deployed promptly to all managed macOS systems, particularly in environments handling sensitive user data.

Patch guidance

Verify and deploy macOS Tahoe 26.1 from Apple's official Software Update mechanism. Test in a pre-production environment first, particularly for organizations with legacy applications or specific macOS configurations. For managed environments, use your mobile device management (MDM) solution to push the update. Apple typically provides security update details and known issues in release notes—review these before broad rollout to identify any compatibility concerns.

Detection guidance

Monitor system logs for sandbox policy violations or app permission denials that might indicate an app attempting to access restricted user data. Endpoint detection and response (EDR) tools should flag apps executing with unusual file-system access patterns, particularly access to user library directories, keychain, or browser profile folders. Network monitoring can help identify unusual data exfiltration attempts. However, the most reliable detection method is to ensure all Macs are running Tahoe 26.1 or later, reducing the attack surface to zero.

Why prioritize this

Although scored as MEDIUM severity, organizations should prioritize this patch because (1) it affects a fundamental trust boundary—the sandbox—that protects user data on every macOS system, (2) data theft is a primary business risk for any organization, (3) the exploit requires no special conditions once a malicious app is present, and (4) the fix is straightforward. Organizations heavy in macOS deployment or handling personally identifiable information should treat this as higher urgency.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects the local-only attack vector, low attack complexity, and user-level privilege requirement. The high confidentiality impact (disclosure of user data) is offset by the lack of integrity or availability impact. The score appropriately captures a meaningful but contained risk—real for users of untrusted apps, less acute for organizations with app-control policies, but universally relevant to macOS security posture.

Frequently asked questions