Executive brief
macOS is the operating system running on Apple computers. A malicious application installed on an affected Mac may be able to bypass the system's Privacy preferences and Parental Controls, potentially gaining unauthorized access to user data and system functions that should be restricted. This could allow an attacker to exfiltrate sensitive information or perform actions a user has explicitly blocked.
Technical details
This vulnerability is a permissions/authorization bypass in the Accounts subsystem of macOS, specifically affecting how the system manages state during privacy preference checks. The root cause is an authorization issue in how the system validates whether an application has the required entitlements to access restricted user data and functions. A local app (already installed on the system) can exploit this by making requests that bypass the intended privacy gate during a narrow state window. The vulnerability requires the app to already be running on the system (local attack vector, no network required) and does not require user interaction beyond normal app operation. An attacker can achieve unauthorized access to sensitive data that the user has restricted via Privacy preferences. Apple addressed this with improved state management in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Affected products
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: disclosed: Apple security updates published
- 2026-09-14: patched: Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7