CVE-2026-49269 describes a vulnerability in Apple M1 GPUs where register file data is retained between compute shader dispatches across different sandboxed processes. This allows a malicious Metal app to read stale GPU register values left by another sandboxed app, leading to potential leakage of sensitive information such as a 128-bit secret generated by the victim app. The issue is limited to legacy hardware and has been resolved in newer Apple Silicon hardware at the hardware level. No software patch or remediation level is currently documented.

The vulnerability can lead to information disclosure between sandboxed applications on affected legacy Apple M1 GPU hardware. Specifically, sensitive data stored in GPU registers by one app can be read by another app, violating process isolation and confidentiality. There is no indication of broader system compromise or code execution from the provided data.

The vendor has indicated that this vulnerability affects only legacy hardware and has been addressed at the hardware level in current-generation Apple Silicon devices. No software patch or official remediation is documented. Users should upgrade to current-generation Apple Silicon hardware to mitigate this issue. For legacy hardware, no specific mitigation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.