macOS creates a fully read/write CDC-ACM serial device node with no TCC gate. Chained with a HID keyboard interface on the same USB composite device, this exfiltrates SSH keys, cloud credentials, and secrets in 24 seconds through a channel that shows no consent prompts. Apple was notified on 2026-04-26, declined the report on 2026-05-20, and I am publishing this today after 4 months of silence following my final response.

Pre-auth RCE in screensharingd — SRP frame-length validation returns success on oversized frames, bypassing authentication entirely. Root file read/write → code execution via crontab. No user interaction required.

In this excerpt of a Trend Vulnerability Research Service vulnerability report, Nikolai Skliarenko and Yazhi Wang of the Trend™ Research Team detail a recently patched code execution vulnerability in the Apple macOS operating system. This bug was originally discovered by Hossein Lotfi of the Trend™&

XAR is a file archive format used in macOS, and is part of various file formats, including .xar, .pkg, .safariextz, and .xip files. XAR archives are extracted using the xar command-line utility. XAR was initially developed under open source, however, the original project appears to be no longer maintained. Apple maintains their own branch of XAR for macOS, which is published on the Apple Open Source website. The xar utility suffers from a logical vulnerability which allows files to be extracted outside of the intended destination folder, resulting in arbitrary file write anywhere on the filesystem (permissions allowing).

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities - sslab-gatech/pwn2own2020

A story about macOS File Quarantine, 10years old bug, OneDrive entitlements and UX Security in apps.

Quarantine nights Exploring File Quarantine handling in macOS Apps / @Metnёw

This post explores the potential abuse of some features within the macOS Calendar application. It covers multiple attack paths that could lead to code execution and discusses the protections Apple has in place to mitigate them.

TL;DR You can run an arbitrary command on a VMware Fusion guest VM through a website without any priory knowledge. Basically VMware Fusion is starting up a websocket listening only on the localhost. You can fully control all the VMs (also create/delete snapshots, whatever you want) through this websocket interface, including launching apps. You need to have VMware Tools installed on the guest for launching apps, but honestly who doesn’t have it installed.

Revisiting Helpviewer.app to hack Parallels for Mac

Application security issues found by Assetnote

[ WebAsm OOB ArrayBuffer ] WebAsm instance builder reads imports from an attacker-controlled object in v8/src/wasm/wasm-module.cc:1625 ProcessImports(). Imports can be getters, which run while the ins…

André Baptista - Reverse engineer, exploitation researcher and bug bounty hunter.

A Pwn2Own exploit chain. Contribute to saelo/pwn2own2018 development by creating an account on GitHub.