---
id: "CVE-2026-86933"
kind: "vulnerability"
aliases: ["CVE-2026-86933"]
title: "Apple macOS: sandbox permissions flaw exposed user contact information to apps"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["apple", "endpoint", "macos", "other"]
not_affected_if: ["macos-golden-gate-27-or-later"]
published_at: "2026-10-20T01:17:27+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T04:46:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86933", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Apple macOS: sandbox permissions flaw exposed user contact information to apps

A permissions issue in macOS let an app read information about the user's contacts, and Apple fixed it by adding sandbox restrictions. The sources do not describe the exact code path involved.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the macOS version with `sw_vers`, then compare it against the fixed release named by Apple (macOS Golden Gate 27).

## Fix

- Update macOS to Golden Gate 27 or later, as named in the NVD entry.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86933

## From the sources

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_