Microsoft finds serious vulnerability in macOS

A vulnerability in macOS makes it possible to bypass the App Sandbox. The App Sandbox is one of the most important measures against attacks on macOS.

The vulnerability was discovered by Microsoft. The Microsoft 365 Defender Research Team found the issue while investigating the risks of VBA macros on macOS.

The vulnerability sidelines the App Sandbox. A serious problem, because the App Sandbox is one of the most important measures against attacks on macOS.

App Sandbox

The App Sandbox consists of rules for developers of macOS apps. If you want to publish an application on the Mac App Store, you have to follow the rules. For example, the rules ensure that an application has limited access to user data. If the application contains a vulnerability, the damage will be limited.

The team at Microsoft found a way to get around the App Sandbox. “An attacker could exploit the vulnerability to empower itself and execute malicious code, such as a malware payload,” the researchers shared.

patch

The vulnerability was registered as CVE-2022-26706. Microsoft notified Apple of the issue in October 2021. On May 16, 2022, Apple released a security update. The update was included in macOS Monterey 12.4.

If you work with 12.4 or a later version, you are safe. If not, “we encourage you to install the security updates as soon as possible, ” the researchers said . “In addition, we would like to thank the Apple team for their responsiveness.”