CVE-2026-28914
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.
CVSS
5.5
Medium
EPSS
0.1%
p5
KEV
—
Exploit Today
1
0-100
Published: May 11, 2026 · Last modified: Jul 27, 2026 · CWE-358 · CWE-693
0.1%EPSS · 30 days0.1%
2026-07-022026-07-29
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-180159.6 CRI—
——0Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)8hCVE-2026-179434.3 MED—
——0Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)4hCVE-2026-179366.5 MED—
——0Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)4hCVE-2026-179316.5 MED—
——0Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)4hCVE-2026-179236.5 MED—
——0Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chromium security severity: Low)4hCVE-2026-179196.8 MED—
——0Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low)10h