CVE-2026-28845: 
macOS vulnerability analysis and mitigation

CVE-2026-28845 is an improper authorization vulnerability in Apple macOS that allows a local app to access protected user data via LaunchServices. The issue stems from insufficient authorization checks and was addressed with improved state management in macOS Tahoe 26.4, released March 24, 2026. It affects macOS Tahoe versions prior to 26.4 and carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Advisory).

The vulnerability is classified as CWE-285 (Improper Authorization) and resides in the LaunchServices component of macOS Tahoe. An unprivileged local app can exploit insufficient authorization checks to access protected user data without requiring elevated privileges, though user interaction is required. Apple credited multiple researchers including Yuebin Sun (@yuebinsun2020), Nathaniel Oh (@calysteon), Kirin (@Pwnrin), Wojciech Regula of SecuRing, and others for discovering this issue (Apple Advisory).

Successful exploitation results in unauthorized access to protected user data, representing a high confidentiality impact with no effect on integrity or availability. The attack is local in scope, requiring a malicious app to be installed and user interaction to trigger, limiting the blast radius compared to remote vulnerabilities. Sensitive data accessible through LaunchServices could include information about installed applications and associated user data (Apple Advisory).

Apple has released a fix in macOS Tahoe 26.4 (released March 24, 2026), which addresses the issue through improved authorization state management in LaunchServices. Users should update to macOS Tahoe 26.4 or later as the primary remediation. As an additional precaution, administrators should review installed applications and restrict installation of untrusted apps (Apple Advisory).

The vulnerability was disclosed as part of Apple's March 2026 security update covering macOS Tahoe 26.4, which addressed over 140 vulnerabilities across Apple platforms. The CIS Security advisory noted multiple vulnerabilities in Apple products that could allow for privilege escalation and data exposure. No significant individual researcher commentary or social media discussion specific to CVE-2026-28845 has been identified beyond standard vulnerability tracking coverage (Apple Advisory).