Apple has fixed a flaw in macOS that could allow a malicious app to break out of its sandbox, the set of restrictions that stops an app reaching files, hardware and data it has not been given access to. The fix is in macOS Tahoe 26.7, macOS Sequoia 15.8 and macOS Golden Gate 27, all released on 14 September 2026, so Macs that are not yet on one of those versions remain exposed.
The flaw, tracked as CVE-2026-65381, sits in AppleMobileFileIntegrity, the part of macOS that checks an app’s entitlements, the permissions it is allowed to use. Apple’s advisories describe the impact as “A malicious app may be able to break out of its sandbox” and say “a validation issue existed in the entitlement verification”, which it addressed “with improved validation of the process entitlement”. Apple credits the researcher Mickey Jin with reporting it.
How serious it is
The US National Vulnerability Database, run by NIST, gives the flaw its maximum score of 10.0 (critical), scoring it as exploitable over a network with no privileges or user interaction. The US Cybersecurity and Infrastructure Security Agency (CISA), in its own assessment on the same record, scores it 8.8 (high), treating it as a local attack that needs a low level of access to the Mac. Both classify it as a missing authorisation weakness.
Apple’s three advisories do not say the flaw has been exploited. CISA’s assessment of 17 September records exploitation as “none”, and the flaw does not appear in CISA’s catalogue of known exploited vulnerabilities as of its 23 October 2026 edition.
Which Macs are covered
Apple lists the Golden Gate 27 fix for the MacBook Neo (2026) and Apple silicon Macs: MacBook Air and MacBook Pro (2020 and later), iMac (2021 and later), Mac mini (2020 and later), Mac Studio (2022 and later) and Mac Pro (2023). Macs that stay on the older releases get the same fix through macOS Tahoe 26.7 and macOS Sequoia 15.8. According to the CVE record, every macOS Sequoia version before 15.8, Tahoe version before 26.7 and release before Golden Gate 27 is affected.
What UK users and businesses should do
For individuals, the step is to install the update through System Settings, General, Software Update. For UK businesses and IT teams that manage Mac fleets, the CVE record gives the minimum fixed versions to check against: Sequoia 15.8, Tahoe 26.7 or Golden Gate 27. The same releases also fixed a long list of other security issues, set out in Apple’s advisories.