Loading story…
A critical vulnerability in macOS, identified as CVE-2025-43530, allows attackers to bypass the Transparency, Consent, and Control (TCC) framework, which is designed to protect sensitive user data such as microphone, camera, and document access. The flaw is exploited through the VoiceOver screen reader framework and the com.apple.scrod service, both of which possess elevated system permissions. Attackers can leverage this vulnerability to execute arbitrary AppleScript commands and send AppleEvents to any application, including Finder, thereby circumventing TCC security controls without requiring administrative privileges.
The attack can be carried out in two primary ways: by injecting malicious code into Apple-signed system binaries, exploiting the system's failure to properly distinguish between legitimate and compromised processes, and by performing a Time-of-Check-Time-of-Use (TOCTOU) attack to manipulate applications between security verification and execution. Successful exploitation grants attackers the ability to access sensitive documents, control the microphone, and execute code without user consent, effectively nullifying TCC protections on affected macOS systems.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly disclosed CVE-2025-43530, a macOS Transparency, Consent, and Control bypass involving VoiceOver and the com.apple.scrod service that can allow arbitrary AppleScript execution and access to sensitive data without user consent. Reports also noted that a working proof-of-concept exploit was publicly available, increasing the risk of abuse.
Apple addressed CVE-2025-43530 in macOS 26.2 by strengthening validation around trusted services with a more robust entitlement-based check. Users and organizations were advised to update to macOS 26.2 or later to mitigate the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLabs reported that macOS **Transparency, Consent, and Control (TCC)** protections can be bypassed through a mix of design weaknesses and unintended behavior, potentially allowing access to data and services that normally require explicit user approval. TCC is Apple’s privacy framework for restricting applications from reaching sensitive resources such as files, microphones, cameras, and other protected user data without consent. The report describes bypass paths that undermine the reliability of those safeguards, showing that privacy enforcement on macOS can fail even when users expect TCC prompts and policy checks to block unauthorized access. The findings highlight risk for enterprises that rely on native macOS controls to protect sensitive information, and they underscore the need to pair Apple’s built-in privacy model with additional monitoring, hardening, and application control defenses.
Jun 29, 2026
Researchers at XM Cyber disclosed a macOS privilege-escalation technique that allows a standard, non-administrative user to disable enterprise security software and invoke privileged functions without administrator credentials or kernel exploits. The attack chain abuses legitimate macOS behavior by combining weakly validated XPC connections, malicious payload injection into Interface Builder NIB files, and a newly described misuse of the kernel code-signing trust cache, which can continue trusting an application's `CDHash` after a legitimately signed app has run. XM Cyber said it successfully used the method to silently unload or permanently deactivate **CrowdStrike Falcon Sensor**, **Kandji MDM**, and a third unnamed EDR product without triggering alerts. Kandji addressed the issue in an updated agent release and assigned **`CVE-2026-39118`**, CrowdStrike reportedly paid a bug bounty and added detections while disclosure continues, and another vendor is developing a patch; XM Cyber also warned that Apple does not plan to remediate the underlying macOS design issue, leaving software vendors to implement their own mitigations.
Jun 29, 2026
Apple patched a logic flaw in macOS Screen Sharing, tracked as **CVE-2026-43760**, that allows remote attackers using legacy VNC password authentication to escalate to **root-level** file operations and command execution. The vulnerability affects the `screensharingd` service and its file-copy helpers when **Screen Sharing** or **Remote Management** is enabled with the **"VNC viewers may control screen with password"** option, because VNC-authenticated sessions are not mapped to a macOS user identity and the helpers continue running as root. Researchers showed the bug could be abused to read protected files and write attacker-controlled files into privileged locations, including `/private/etc/sudoers.d`, to grant a non-admin account passwordless `sudo` and obtain a fully remote interactive root shell. The flaw affects **macOS Tahoe prior to 26.6** and **macOS Sonoma prior to 14.8.8**, and defenders report it is being actively exploited in the wild to deploy **Monero cryptocurrency miners** on unpatched Macs. Apple rated the issue at 5.5 severity, while outside analysis said real-world impact could be significantly higher in exposed configurations. Apple released fixes in **macOS Tahoe 26.6** and **macOS Sonoma 14.8.8** and advised organizations that cannot patch immediately to disable the legacy VNC password option or turn off Screen Sharing and Remote Management to remove the attack path.
Aug 20, 2026