Sandbox escape caused by a race condition in Apple iOS, iPadOS, and macOS

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

• Apple iOS and iPadOS: Versions beginning at 0 and less than 27 are identified as affected. The issue is fixed in iOS 27 and iPadOS 27.
• Apple macOS: Versions beginning at 0 and less than 27 are identified as affected. The issue is fixed in macOS Golden Gate 27.
• The record does not establish the status of other Apple branches or parallel release branches, which should not be inferred from the named fixes.

Apple identifies the Foundation component as affected. The weakness is a race condition, classified as CWE-362, and Apple says additional validation addresses it. The attacker-controlled code is a malicious app running locally on the device. The supplied attack characteristics indicate low privileges, no user interaction, and high attack complexity. The impact crosses the sandbox boundary, but Apple does not disclose the precise shared resource, synchronization failure, timing window, or validation path. The exact exploit sequence and post-escape capabilities therefore remain unknown.

• Reachability: Local, through a malicious app running on the device.
• Preconditions: The app requires low privileges; no user interaction is indicated.
• Complexity: High, consistent with the race condition and required timing.
• Exploitation status: The record does not identify a public exploit. CISA ADP enrichment records exploitation as none at the time of assessment. No specific exploit, campaign, victim, or breach is named.

A successful exploit may change the process security scope by allowing it to leave its sandbox. That could permit access to protected files, services, or other system resources that the app could not normally reach, with possible confidentiality, integrity, and availability consequences. The record does not establish root privileges, kernel execution, arbitrary code execution, persistence, or a particular affected file or service. Actual impact depends on the resources exposed after the sandbox boundary is crossed and on the device's existing permissions and controls.

Successful exploitation could let a malicious app operate outside its intended sandbox. Depending on the permissions and services reachable by the escaped process, this may expose protected data or enable changes to resources that the sandbox should block. The record does not confirm a specific data-theft, persistence, privilege-escalation, or service-outage scenario. The main operational task is to identify affected endpoints and prioritize operating-system updates.

1. Update Apple iOS and iPadOS to iOS 27 or iPadOS 27, as applicable.
2. Update Apple macOS to macOS Golden Gate 27.
3. Verify each product branch separately in the asset inventory after updating; a fix for one branch does not by itself prove that other branches are protected.
4. If updating is not immediately possible, the record provides no Apple workaround or official mitigation. As a precaution, restrict installation and execution of untrusted apps, but do not treat that control as a substitute for the update.

• Inventory Apple devices, installed operating-system releases, and update status; compare them with the version boundaries in affected_summary and remediation.
• Check the Apple advisory applicability for each iPhone, iPad, and Mac device before marking it as protected.
• Review application inventory for untrusted apps or apps installed outside organizational controls. This is a precaution, not a vulnerability-specific indicator.
• No CVE-specific log event, IOC, or telemetry pattern is provided. The absence of such evidence does not establish that a device is safe.