Apple published the security notes for macOS Golden Gate 27.2. They list separate fixes, each with its own CVE number, a public ID for one flaw. One lets a remote attacker break out of the WebContent sandbox, the walled-off area that limits web pages. Others let an app gain root, meaning full control of the Mac. Several let an app, a crafted file or a ZIP archive bypass Gatekeeper, the check on downloaded software.
Apple says it does not confirm security issues until patches are ready. None of the entries says an attack has used these flaws, or that any can be chained. The notes give no release date and do not say how many people could be affected.
This is our reading: each barrier stops a different step. The sandbox limits a web page already running hostile code. Root limits an app already on the Mac. Gatekeeper acts when software arrives. An attacker would need several flaws to pass all three. Fleet owners can ask how long update deferrals last, how unmanaged Macs are tracked, and who owns machines that lag.