MICROSOFT UNCOVERS MACOS FLAW ALLOWING BYPASS TCC PROTECTIONS AND EXPOSING SENSITIVE DATA

Summary from the TLDR InfoSec newsletter

Microsoft discovered CVE-2025-31199, a macOS vulnerability that allows attackers to bypass Transparency, Consent, and Control (TCC) protections by exploiting Spotlight's .mdimporter plugins to access sensitive data without user permission. The flaw enables access to protected directories, such as Downloads and Apple Intelligence cache files, which contain GPS locations, face recognition data, and device metadata that sync across iCloud-linked devices. Apple patched the vulnerability in macOS Sequoia 15.4 in March following the development of a proof-of-concept tool by Microsoft called "Sploitlight" which demonstrated the exploit.