CVE-2026-65393

CVE-2026-65393 is a permissions/validation weakness in Apple's macOS (and related tooling in Xcode) in which an app running on an affected system may be able to access user-sensitive data that it should not be permitted to read. Exploitation requires a malicious or compromised application to already be present and executing on the victim's Mac, where it abuses the insufficient permission validation rather than a remotely reachable network flaw. A successful abuser gains access to sensitive user data (for example, data protected by macOS privacy controls), but there is no indication of arbitrary code execution or remote compromise. The issue affects users running macOS versions prior to macOS Golden Gate 27, as well as developers on Xcode versions prior to Xcode 27, since fixes shipped in both releases as part of a large Apple security update. There is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in the CISA KEV catalog.

What to do: Update to macOS Golden Gate 27 as soon as practical, and developers should move to Xcode 27 so apps are built against the corrected validation behavior. In the interim, audit installed applications and the permissions granted under System Settings > Privacy & Security, revoking unusual data-access grants and removing untrusted apps, since exploitation depends on a malicious app already running locally. Monitor Apple's security advisory and threat feeds, as this flaw was patched alongside a very large batch of fixes that attackers may prioritize for reverse engineering.