Executive brief
A security vulnerability in macOS Tahoe could allow a malicious application to bypass Gatekeeper, the security feature designed to ensure only trusted software runs on your Mac. By circumventing these checks, an unauthorized app might execute on the system without the usual security warnings or verification. This issue has been resolved in macOS Tahoe 26.4 by implementing stricter permission requirements.
Technical details
A permissions vulnerability exists in the AppleScript component of macOS Tahoe. The flaw stems from insufficient restrictions during permission checks, which can be exploited by a local application to bypass Gatekeeper's verification mechanisms. While the attack requires user interaction (UI:R), it allows an attacker to circumvent security policies intended to block untrusted code. Apple addressed this issue in macOS Tahoe 26.4 by implementing additional restrictions and improved state management.
Affected products
- Apple macOS Tahoe versions before 26.4
Timeline
- 2026-03-24: patched: Fixed in macOS Tahoe 26.4
- 2026-03-25: disclosed: Initial NVD publication