Apple published a security page for macOS Tahoe on July 28, 2026, listing more than a dozen security holes that have now been fixed. The page, hosted at support.apple.com, credits both independent researchers and professional security teams with finding the bugs.

The most dangerous bugs in this batch affect the kernel — the part of the operating system that sits at the very center, controlling memory, hardware, and which programs can do what. When the kernel is compromised, an attacker can potentially take over the entire computer. CVE-2026-64767, reported by Dave G., could let a remote attacker crash the system or tamper with kernel memory. CVE-2026-64695, reported by Peter Malone, could do the same through a remote user. CVE-2026-43681, reported by impost0r (ret2plt) and David Ige of Beryllium Security, could let someone with access to the machine read private kernel memory. And CVE-2026-43776, reported by Irvin Wang, Peter Malone, and Nicolas Rabrenovic, could be triggered just by opening a maliciously crafted file and could let an attacker run whatever code they wanted on the machine. Apple fixed all of these with improved memory handling.

Two bugs could let an app gain more access than it should have. CVE-2026-43749, reported by Adam Franke, Ashish Kunwar, and Trung Nguyen of CyStack, could allow an app to gain root privileges — the highest level of control on the system. Apple fixed it with better validation of file paths. CVE-2026-43748, reported by an anonymous researcher, tamdao, and Franco Belman of Blackwing Intelligence, could crash the system. CVE-2026-28928, reported by Dun, could cause the same kind of crash.

Apple also fixed problems with what it calls the sandbox. A sandbox is a security fence that keeps apps isolated — an app in its sandbox should only be able to do its own work, not touch other apps or system data. CVE-2026-64737, reported by Robert Mindo, could let a malicious app break out of that fence entirely. CVE-2026-43819, reported by Omar Cerrito, could let an app access sensitive user data; Apple addressed it with tighter sandbox restrictions. The security page also references an entry for a sandbox file-read vulnerability fixed by removing vulnerable code, though the bug's tracking number was cut off in Apple's published page.

Several fixes deal with apps accessing your personal data without permission. CVE-2026-43801, reported by Rahul Raj, could let an app reach sensitive user data due to insufficient checks. CVE-2026-43781, reported by Pinak Oza, could do the same through a timing flaw in how the system handles tasks. CVE-2026-43672, reported by Lee Jaeyeong, could let a malicious app bypass your Privacy settings. And CVE-2026-64733, reported by Rosyna Keller of Totally Not Malicious Software, could let an app fingerprint you — quietly collecting identifying details about your device. Apple fixed it with improved data protection.

CVE-2026-23918, reported by Yulia Mertsalova, is a denial-of-service bug, meaning it could be used to make the system stop working. It comes from open-source code that macOS Tahoe uses. Its tracking number was assigned by a third party rather than Apple, placing it in a category the company handles differently in its disclosure process.

The list of people who reported these bugs is wide: independent researchers, members of security firms (CyStack, Beryllium Security, Blackwing Intelligence), and at least one anonymous submitter. Having multiple researchers find separate kernel bugs in a single update suggests that outside scrutiny of macOS Tahoe's core code is ongoing and active.

The mix of bugs here — memory flaws near the kernel, sandbox boundary problems, and data-access issues that get around privacy settings — is what security teams have come to expect from major macOS releases. The kernel bugs and the one that allows arbitrary code execution are the most severe, because they can be triggered just by opening a file or through a remote interaction. The sandbox escape and root-privilege bugs are less likely to happen but can be very damaging in targeted attacks, since they require the attacker to already have some access to the machine.

One thing worth noting: the fingerprinting bug and the Privacy settings bypass are the kinds of issues that often get less attention in corporate environments, where IT teams tend to prioritize kernel and access-control bugs first. But if you work in a regulated industry or care deeply about privacy, these two fixes deserve the same level of urgency.

Apple's security content pages are the standard reference for what each macOS update fixes, and this Tahoe page follows that format. The page does not say whether any of these bugs were being actively exploited in the wild — Apple typically only shares that information for vulnerabilities it knows are under active attack. Anyone running macOS Tahoe should install the full update rather than picking and choosing which fixes matter to them.