macOS Tahoe: Vulnerability in sandbox remained unclosed for five months | News

Apple’s developers have put a lot of effort into the security of the operating system over the past quarter century. The Transparency, Consent & Control (TCC) guidelines are a result of this: users decide when which programs are allowed to access general-use folders, otherwise they are limited to their own sandbox. However, for internal purposes and for reasons of ease of use, there are exceptions, which in turn can be exploited for illegitimate purposes. The software developers at Mysk document one such example: Last fall they discovered a special privilege for the “Archive Utility”. They immediately reported it to Apple. Still, it took five months to close the gap.

Mysk discovered by chance that the “Archive Utility” program had a master key: The tool stored in /System/Library/CoreServices/Applications has read and write access to all sandbox containers, so it is available to every program as a compression tool. This in itself does not represent a security vulnerability, because Mysk was unable to redirect the result of the compression to another location: the default “archive-info” (an obvious typo, it should be “archive-into”) could not be changed arbitrarily.

Special rule file access
But for this purpose, the researchers were able to use a special form of access rule that Howard Oakley recently reported on: an intent release, which is stored in the extended attributes and exists in parallel with the TCC releases. This can be done using drag-and-drop, for example.

Dangerous with script
A clever attack could, with comparatively little effort, cause a user to compromise their Mac’s data, argues Mysk: All you have to do is convince the user to run a terminal script and then drag one icon onto another. They visualize this using self-designed symbols, which appear tempting to users.

“Lead in gold” – that sounds tempting. Symbolic links are hidden behind the icons.

Fixed in macOS 26.4
Apple fixed the vulnerability with the update to macOS 26.4 and mentions the vulnerability with the official name CVE-2026-28910 in the security advisories: “A malicious app may be able to access arbitrary user data.” In English, the app is called “malicious”, which would probably be better translated as “malicious” rather than “damaging”. Mysk is pleased that Apple has acknowledged and fixed the error, but is surprised at the long processing time. The researchers have not tested whether the error also applies to older versions of macOS.

Not the first gap in archiving
Already in 2022, Apple had to make improvements to the archiving program: security researchers managed to manipulate a ZIP file so that the unpacked file was not subjected to the usual quarantine. Apple fixed the error with the update to macOS 12.6.2 and 11.7.2.