Security News > 2021 > May > Apple patches macOS flaw exploited by malware to secretly snap screenshots

Apple has patched a hole in macOS that has been exploited by malware to secretly take screenshots on victims' Macs.

Three flaws, including one spotted by Google's Project Zero, fixed in iOS 14.6 and iPadOS 14.6 can be exploited by a malicious app to run code with kernel-level privileges, allowing malicious software to completely take over the device.

Bug hunters found seven CVE flaws in the browser engine, including two that would allow arbitrary code execution - meaning they can be exploited by malicious webpages to compromise iPhones and iPads - and a couple of nasty universal cross site scripting issues.

Trend's flaw finders reported 10 CVE issues, three of which can be exploited to achieve code execution, and a handful of memory corruption issues.

Apple doesn't report that any of these bugs are being exploited in the wild as yet, though we know how quick malware developers are at turning patches into exploits.

Many of flaws found and addressed in iOS and iPadOS cropped up and are fixed in macOS as well, particularly in the kernel, WebKit and Model I/O, though there are some holes unique to the desktop OS. On the priority list is, ironically, a security bypass issue with Apple's Transparency Consent and Control mechanism that is being exploited in the wild.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/05/24/ios_macos_patches/