New TCC Bypass (CVE-2025-43530) Exposes macOS to Unchecked Automation

Security researchers have disclosed CVE-2025-43530, a TCC bypass that allows unchecked automation on macOS by leveraging a flaw in the ScreenReader[.]framework and the private com.apple.scrod service. The report explains that the gatekeeper is broken because it relies on code signing, trusting Apple-signed processes even when they can be manipulated, and because of a TOCTOU issue that verifies a client by file path rather than its secure audit token.

By exploiting this, an attacker could automate the machine using AppleScript and send AppleEvents to target processes, effectively bypassing the TCC protections and potentially accessing data such as photos, contacts or location without a user prompt. Apple has released a fix, noting that “This issue was addressed with improved checks,” with the patched releases including macOS Tahoe 26.2, macOS Sonoma 14.8.3, macOS Sequoia 15.7.3, and iOS/iPadOS 18.7.3. The vulnerability was publicised on 6 January 2026, and the exploit code has been published online for PoC purposes.