Loading vulnerability…
macOS TCC Privacy Preferences Bypass
CVE-2021-30713 is a macOS vulnerability in Apple’s Transparency, Consent, and Control (TCC) privacy framework that was fixed in macOS Big Sur 11.4. Apple described the issue as a permissions problem addressed through improved validation. Successful exploitation allows a malicious application to bypass Privacy preferences and inherit or obtain TCC-governed permissions without the user’s explicit approval. Reporting on in-the-wild abuse linked the flaw to XCSSET malware, which used the bypass to access screen-recording-related capabilities and capture screenshots without triggering the expected consent prompt. Analysis of the abuse indicated the issue could be leveraged by placing a malicious app component within the bundle of an already trusted or previously authorized application so that the malicious component inherited the parent application's TCC permissions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation undermines macOS privacy controls enforced by TCC and can grant unauthorized access to protected resources that normally require user consent. Observed abuse enabled silent screenshot capture, and reporting indicated the bypass could also expose other TCC-protected capabilities, including permissions comparable to Screen Recording and potentially Full Disk Access, depending on the donor application's granted privileges. This can facilitate surveillance, collection of sensitive user data, and follow-on compromise without presenting the user with the normal privacy authorization workflow.
If you can’t patch tonight, do this now.
Until patching is complete, reduce exposure by limiting execution of untrusted or unsigned applications, especially developer-targeted software obtained from repositories or shared projects. Restrict installation of third-party applications to trusted sources, review and minimize existing TCC grants for high-risk permissions, and monitor for anomalous application bundling, nested app execution, and code-signing mismatches that may indicate attempts to piggyback on a previously authorized application. Additional endpoint monitoring focused on unexpected use of screen capture or other TCC-protected services can help detect abuse.
Patch, then assume compromise.
Upgrade affected systems to macOS Big Sur 11.4 or later, where Apple fixed the issue through improved validation in the TCC permission handling path. Ensure all managed macOS endpoints are fully patched and verify that legacy or deferred-update systems are brought to a supported release containing Apple's fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.