ANALYZING CVE-2025-31191: A MACOS SECURITY-SCOPED BOOKMARKS SANDBOX ESCAPE

Summary from the TLDR InfoSec newsletter

Microsoft discovered a vulnerability in macOS that allowed applications to escape the App Sandbox without user interaction while researching macro exploit detection for Microsoft Office in April 2024. Security-scoped bookmarks are a macOS mechanism that bypasses the App Sandbox using explicit, persistent user choices. Microsoft researchers discovered that the Keychain entry used for security-scoped bookmarks can be overwritten to sign new bookmarks.