Microsoft claims it found a major macOS security bug that could put all your data at risk

Microsoft information researchers person uncovered a vulnerability successful nan macOS operating system that could let threat actors to summation entree to delicate information stored connected nan device.

The institution elaborate its findings successful a blog post, which claimed nan flaw bypasses nan operating system’s Transparency, Consent, and Control (TCC) technology, and it was dubbed “HM Surf”.

The bug is now tracked arsenic CVE-2024-44133. It has a severity people of 5.5 (medium), and was fixed successful mid-September 2024.

What astir Chrome, aliases Firefox?

Microsoft explained that nan vulnerability removes TCC protection for nan Safari browser directory, and allows for nan modification of a configuration record successful that directory. As a result, nan malicious character gains entree to personification data, specified arsenic browsed pages, nan camera, microphone, location, and much - each without personification consent.

While nan bug being patched is decidedly bully news, location is simply a caveat. As explained successful nan article, only Safari uses nan caller protections afforded by nan TCC, astatine nan moment. That intends different browsers, specified arsenic Chrome, aliases Firefox, “do not person nan aforesaid backstage entitlements arsenic Apple applications,” truthful they can’t activity astir nan TCC checks. In different words, erstwhile a personification approves TCC checks, nan app is nan 1 maintaining entree to nan privateness database.

“Microsoft is presently collaborating pinch different awesome browser vendors to analyse nan benefits of hardening section configuration files,” nan institution explained.

Apple users are encouraged to use nan information update arsenic soon arsenic possible, since Microsoft claims to person recovered a imaginable lawsuit of in-the-wild abuse:

“Behavior monitoring protections successful Microsoft Defender for Endpoint has detected activity associated pinch Adload, a prevalent macOS threat family, perchance exploiting this vulnerability,” it concluded.

More from TechRadar Pro

• Google hails move to Rust for immense driblet successful representation vulnerabilities
• Here's a database of nan best firewalls today
• These are nan best endpoint protection tools correct now