Microsoft Defender for Endpoint can detect suspicious keychain manipulation attempts related to this exploit, adding an additional layer of protection for organizations using the security solution. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. While Apple correctly restricted reading access to the com.apple.scopedbookmarksagent.xpc keychain item through strict Access Control Lists (ACL), researchers discovered the protection did not prevent deletion or replacement of the item. When the application attempts to access files using these bookmarks, the ScopedBookmarkAgent validates the forged credentials and grants access without additional user consent. The proof-of-concept demonstrated by Microsoft shows how a malicious Office macro could implement this attack chain, though the vulnerability affects any sandboxed app using security-scoped bookmarks. This case highlights how sophisticated attackers continue to find ways to circumvent sandbox protections, reinforcing the need for prompt security updates and comprehensive endpoint security solutions. Apple has addressed the vulnerability “through improved state management” in security updates released for affected systems. This vulnerability affects multiple Apple operating systems, including macOS Ventura, macOS Sequoia, macOS Sonoma, tvOS, iOS, and iPadOS. The exploit enables unauthorized access to sensitive user data and potentially allows for arbitrary code execution with elevated privileges. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. According to Microsoft’s detailed analysis, attackers can exploit a critical flaw in how macOS manages these bookmarks. A security vulnerability in macOS has been discovered. After deletion, attackers can insert a new secret with a known value and attach a permissive ACL that allows broader access. She is covering various cyber security incidents happening in the Cyber Space. It allows malicious actors to escape the App Sandbox protection by manipulating security-scoped bookmarks.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 02 May 2025 10:50:06 +0000