Microsoft Uncovers Safety Flaw In macOS Highlight That Might Leak Non-public Information

Microsoft’s Risk Intelligence group has identified a now-fixed safety vulnerability in Apple’s macOS Highlight search device that might have allowed unauthorized entry to delicate consumer knowledge. The difficulty, internally dubbed “Sploitlight”, stemmed from how Highlight dealt with plugin recordsdata and doubtlessly bypassed Apple’s privateness safety framework referred to as Transparency, Consent, and Management (TCC).

The flaw made it doable for attackers to use Highlight’s plugin system—parts that usually assist index app content material for search and are confined inside a sandbox setting. Nonetheless, Microsoft’s researchers found a way to govern these plugins to realize entry to cached knowledge generated by Apple’s AI options.

If exploited, the vulnerability may have uncovered a variety of personal info, together with:

• Exact location knowledge

• Photograph and video metadata

• Facial recognition knowledge from the Images app

• Search historical past

• Summaries generated by AI instruments, reminiscent of electronic mail content material

• Consumer preferences and settings

Regardless of the intense implications, Microsoft confirmed that the vulnerability was not actively exploited. Following accountable disclosure practices, the corporate reported its findings to Apple, which shortly addressed the problem.

Apple launched a repair as a part of macOS 15.4 and iOS 18.4, each rolled out on March 31. In line with Apple’s safety documentation, the patch concerned bettering how the system handles sure varieties of knowledge, serving to to make sure stricter management over plugin habits. Alongside the Highlight repair, Apple additionally resolved two further vulnerabilities reported by Microsoft—one associated to symbolic hyperlink validation and one other involving system state administration.

This incident underscores the significance of cross-company collaboration in addressing rising safety threats, particularly as platforms proceed to combine AI and machine studying options. It additionally highlights the worth of normal system updates, as many vulnerabilities are addressed quietly behind the scenes.

For finish customers, no motion is required past guaranteeing that gadgets are updated. The difficulty has been resolved, and Apple’s fast response prevented the vulnerability from being weaponized in real-world assaults.

Filed in Apple >Computers. Learn extra about Apple, Cybersecurity, macOS, Microsoft, Privacy and Security.