hm-surf

HM-Surf evaluator Evaluates susceptibility to CVE-2024-44133 of common macOS browsers. Also contains the HTML that takes a screenshot and downloads it along with location extraction. Usage - evaluator To run the evaluator, which evaluates CVE-2024-44133 on all common macOS browsers, run: python3 ...

MSF-screenrecord-on-MacOS

MSF-screenrecord-on-MacOS !!! This vulnerability has been simultaneously discovered or taken by Sudhakar Muthumani of Primefort Private Limited, Khiem Tran and listed as CVE-2022-22600. This is despite I already emailing Apple regarding this back in 2021. Affected Versions As a student, I have...

CVE-2023-26818

Disclaimer This exploit has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for a...

POC

POC For research purposes only! A public collection of POCs & Exploits for the vulnerabilities I discovered. CVE-2022-22583 PackageKit : An application may be able to access restricted files SIP Bypass CVE-2022-26690 PackageKit : A malicious application may be able to modify protected parts of th...

CVE-2023-38571-a-macOS-TCC-bypass-in-Music-and-TV

Executive summary macOS Music and TV do an insecure rename resulting in FDA by gaining full control over the user's TCC.db I reported this bug in separate tickets for each app, feel free to merge if applicable. The underlying problem is that these apps have FDA but fail to sanitize their file...

CVE-2020-9934

CVE-2020-9934 Esta Prueba de Concepto es un simple programa Swift que se otorgará a sí mismo y a Terminal todas las autorizaciones kTCCService obtenidas de tccd y luego hará cuatro cosas: Crear un archivo llamado "" en el directorio protegido por TCC Leer los datos de dicho archivo desde dentro d...

CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite

CVE-2023-32422-a-macOS-TCC-bypass-in-sqlite...

CVE-2023-42860

CVE-2023-42860 Exploit for CVE-2023-42860 for research purposes only. This exploit works for versions of macOS earlier to 13.3, even though Apple´s changelog says it was fixed in version 14.1. Steps 1. Download the InstallAssistant.pkg 2. Modify the variable TARGETFILE on the exploit.sh file to a...

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal

CVE-2023-32407-a-macOS-TCC-bypass-in-Metal...

CVE-2026-43783

CVE-2026-43783: Repair Permissions - Get Root: LPE via DesktopServicesHelper in macOS 26.5 Originally published on PT SWARM or andrd3v.github.io The daemon that Finder uses to "repair" permissions on iCloud files turned out to be willing to repair permissions on anything - including system...

CVE-2025-24204

CVE-2025-24204 About CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement com.apple.system-task-ports.read to the gcore binary. Exploiting this vulnerabilit...

CVE-2022-26726-POC

CVE-2022-26726 Affected Versions As a student, I have limited access to devices in which I can test this vulnerability. The versions I have tested so far are MacOS 12.3.1, MacOS 12.3, MacOS 12.0, MacOS 10.15.7, and MacOS 11.6.1. The vulnerability works on all the versions tested on. So what is th...

electroniz3r

electroniz3r Получите контроль над разрешениями TCC macOS-приложений Electron с помощью electroniz3r. Инструмент был впервые представлен на DEFCON31 в Лас-Вегасе во время моего доклада ELECTRONizing macOS privacy - a new weapon in your red teaming armory. Обзор $ electroniz3r OVERVIEW: macOS Red...

CVE-2026-89905 LoongArch: BPF: Move arena register slot below TCC context

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

Electron: Parent process code-sign check is spoofable

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypas...

CVE-2026-70597 Electron: Parent process code-sign check is spoofable

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

EUVD-2026-53403

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

PT-2026-68970

Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRON RUN AS NODE and NODE OPTIONS to same-signed parents rely on this check; a local attacker could...

CVE-2026-70597: Time-of-check Time-of-use (TOCTOU) Race Condition

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

macnoise v0.2.0

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...