CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility (opens in new tab)

Like our research? Try Psylo. Psylo is our privacy-first browser for iOS and iPadOS, with a built-in proxy network, per-tab isolated web sessions, and anti-fingerprinting. Using it helps fund more work like this. Download Psylo → Affected Platforms macOS Tahoe 26.0.0 – 26.3.2 Earlier versions of macOS are likely affected as well, but have not been tested. Summary Through Archive Utility, the default compression utility in macOS, an attacker can: