📝🚨 New blog post: How a bug in Archive Utility allowed access to protected app data (including iMessage and WhatsApp chats, and Safari cookies) without any permissions.
The bug could also be exploited to hijack installed apps such as Signal and 1Password to perform phishing attacks.
Apple fixed the issue in macOS 26.4 as CVE-2026-28910, five months after we reported it
macOS Archive Utility Bug Could Let Attackers Hijack Signal Sessions—Fixed in 26.4 (CVE-2026-28910)
macOS Security: Archive Utility Bug Could Expose 1Password Secrets — Fixed in 26.4 (CVE-2026-28910)
macOS Security: Archive Utility bug can expose Safari, Messages, and WhatsApp data - CVE-2026-28910
macOS Bug Lets Attackers Hijack Background Apps to Spy on Clipboard — Fixed in 26.4 (CVE-2026-28910)
Mysk🇨🇦🇩🇪