Executive brief
Apple macOS includes a system component called ATS (App Transport Security) that manages how applications communicate over networks. A logging issue in this component fails to properly redact sensitive user data, allowing malicious apps to access private information through application logs. This could expose account credentials, personal identifiers, and other confidential information stored in system logs.
Technical details
CVE-2026-84525 is a logging/information disclosure vulnerability in the ATS (App Transport Security) framework of macOS. The root cause is inadequate data redaction in logging statements, allowing sensitive user information to be written to system logs in plaintext. An app can read these logs locally to extract user-sensitive data. The vulnerability requires local code execution (the app must be able to run on the system) but does not require special privileges or authentication. The issue is addressed through improved data redaction in the logging implementation. Patches are available in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Affected products
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched