CVE-2026-20628: 
macOS vulnerability analysis and mitigation

CVE-2026-20628 is a sandbox escape vulnerability in Apple's Sandbox component affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw stems from a permissions issue that was addressed with additional restrictions, allowing a malicious app to break out of its sandbox environment. It was disclosed and patched on February 11, 2026, and was discovered by Noah Gregory (wts.dev). Affected versions include iOS and iPadOS before 18.7.5 and before 26.3, macOS Sonoma before 14.8.4, macOS Sequoia before 15.7.4, macOS Tahoe before 26.3, tvOS before 26.3, visionOS before 26.3, and watchOS before 26.3. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Apple Advisory, Feedly).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the Sandbox component across Apple's operating system family. The root cause is a permissions issue — insufficient restrictions that allow an app to exceed its sandboxed execution context and interact with resources or processes outside its permitted scope. Exploitation requires local access and user interaction (e.g., a user running a malicious app), with no privileges required, making it accessible to any installed application. No public technical write-up or proof-of-concept code has been identified at this time (Apple Advisory iOS 26.3, Apple Advisory macOS Sequoia).

Successful exploitation allows a malicious app to escape its sandbox, potentially gaining access to data, files, or system resources belonging to other apps or the operating system itself. The primary impacts are high confidentiality loss (access to sensitive user data outside the app's permitted scope) and high integrity impact (ability to modify data or interact with protected system areas), with no direct availability impact per the CVSS assessment. This could facilitate further privilege escalation or lateral movement within the device if chained with other vulnerabilities (Apple Advisory iOS 18.7.5, Apple Advisory watchOS 26.3).

Apple has released patches addressing CVE-2026-20628 across all affected platforms. Users should update to the following versions or later: iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, iPadOS 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, and watchOS 26.3. Updates can be applied via Settings > General > Software Update on iOS/iPadOS/watchOS, or System Settings > General > Software Update on macOS. No configuration-based workarounds have been published; upgrading to a patched version is the only recommended remediation (Apple Advisory iOS 18.7.5, Apple Advisory macOS Sequoia, Apple Advisory iOS 26.3).

The vulnerability was part of a broader February 2026 Apple security update that addressed over 90 vulnerabilities across Apple's product ecosystem, which received coverage from technology media outlets. Security community coverage noted the breadth of the update, with some outlets highlighting the simultaneous patching of an actively exploited zero-day (CVE-2026-20700 in dyld) in the same release cycle. No specific researcher commentary or notable social media discussion focused exclusively on CVE-2026-20628 has been identified (Cyber Insider, Beyond Machines).