New Unpatched macOS Flaw Lets Apps Spy On Your Safari Browsing History

A new security vulnerability has been discovered in the latest
version of Apple’s macOS Mojave that could allow a malicious
application to access data stored in restricted folders which are
otherwise not accessible to every app.

Discovered by application developer Jeff Johnson on February 8,
the vulnerability is unpatched at the time of writing and impacts
all version of macOS Mojave, including macOS Mojave 10.14.3
Supplemental update released on February 7.

Certain folders in macOS Mojave have restricted access that is
forbidden by default, like ~/Library/Safari, which can be accessed
by only a few applications, such as Finder.

However, Johnson discovered a way to bypass these restrictions in
Mojave, allowing applications to access ~/Library/Safari without
needing any permission from the user or the system, and read users’
web browsing history.

Since the vulnerability has already been reported to Apple and
would not get a patch until at least the next official release of
Mojave, Johnson has decided not to release technical details until
the flaw is resolved.
Johnson also clarified that the privacy protection bypass he
discovered has nothing at all to do with Safari extensions, as the
issue impacts restricted folders and so could potentially impact
all restricted folders on the macOS system, including
~/Library/Safari.

Since the issue resides in the new privacy protection
feature^[2] introduced by Apple in
macOS Mojave 10.14, Apple users running High Sierra on their Mac
computers are not impacted by the vulnerability.

We will update this article as soon as we hear more from the
researcher about the vulnerability. Stay Tuned!