CVE-2026-28828: 
macOS vulnerability analysis and mitigation

CVE-2026-28828 is a permissions/improper access control vulnerability in the macOS TCC (Transparency, Consent, and Control) subsystem that allows an app to access sensitive user data. Discovered and disclosed by Mickey Jin (@patch1t), Apple published the advisory on March 24, 2026, covering macOS Sonoma 14.x (before 14.8.5), macOS Sequoia 15.x (before 15.7.5), and macOS Tahoe 26.x (before 26.4). The vulnerability was addressed by removing the vulnerable code. It carries a CVSS v3.1 base score of 5.3 (Medium) (Apple Sonoma Advisory, Apple Sequoia Advisory, Apple Tahoe Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the macOS TCC framework, which is responsible for enforcing privacy permissions and controlling application access to sensitive user data. The root cause was vulnerable code within TCC that failed to properly restrict application permissions, allowing an app to bypass TCC controls and access protected user data without appropriate authorization. Apple's fix involved removing the vulnerable code entirely rather than patching the permission logic. No public technical write-up or proof-of-concept code has been identified (Apple Sonoma Advisory, Apple Tahoe Advisory).

Successful exploitation allows a malicious application to access sensitive user data that should be protected by macOS's TCC privacy framework, which governs access to resources such as contacts, photos, location, microphone, camera, and other personal data. The confidentiality impact is limited (low) with no integrity or availability impact, as the vulnerability enables unauthorized data read access rather than system compromise or modification. The scope is confined to the affected system, but the exposure of personal user data could facilitate privacy violations or serve as a stepping stone in a broader attack chain (Apple Sonoma Advisory, Apple Sequoia Advisory).

Apple has released patches addressing CVE-2026-28828 by removing the vulnerable TCC code. Users should update to the following versions or later: macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, or macOS Tahoe 26.4. No configuration-based workarounds are available; updating to a patched release is the only recommended remediation. Updates can be applied via System Settings > General > Software Update (Apple Sonoma Advisory, Apple Sequoia Advisory, Apple Tahoe Advisory).

The vulnerability was part of a broader March 2026 Apple security update that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS, which received coverage from security aggregators and industry outlets. The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation. No specific notable researcher commentary or significant social media discussion focused exclusively on CVE-2026-28828 has been identified beyond standard vulnerability tracking coverage (CIS Advisory).