You can call it ironic until the cows come home, but Microsoft appears to have identified a vulnerability in Apple’s macOS Spotlight feature.
Per MacRumors and Microsoft’s blog, Microsoft Threat Intelligence found a Spotlight-related vulnerability that could allow attackers to steal private file data. The issue was outlined in a blog post on Monday, with Microsoft’s threat team calling the exploit “Sploitlight” because it uses Spotlight plugins.
Microsoft identified the vulnerability as a Transparency, Consent, and Control (TCC) bypass that can leak sensitive info cached by Apple Intelligence. Were it to be exploited, attackers could have used it to get precise location data, photo and video metadata, face recognition data from the Photo Library, search history, AI email summaries, user preferences, and more.
Although TCC is designed to prevent apps from accessing personal information without user consent, the current build of Spotlight plugins allow files to appear in search that have been sandboxed by Apple as well as restricted from accessing sensitive files. Microsoft’s researchers appear to have found a way around that and tweaked the app bundles that Spotlight pulls in, leaking file contents.
Microsoft shared details of the bypass with Apple, which Apple addressed in the macOS Sequoia 15.4 and iOS 15.4 updates, which were released on March 31. The vulnerability was never actively exploited, because Apple was able to fix it before it was disclosed.
Apple’s security support document for the update said that the problem was addressed through improved data redaction. Apple fixed two other vulnerabilities that were credited to Microsoft at the same time, with improved validation of symlinks and improved state management.
Stay tuned for additional details as they become available.
