A flaw in macOS allows an application to circumvent user‑defined privacy preferences, enabling it to access protected data that the user has explicitly indicated should remain private. Because this bypass does not rely on exploiting the underlying operating system kernel, it principally threatens confidentiality by allowing an app to read or transmit sensitive content that the user believed to be protected.

The vulnerability affects macOS releases prior to macOS Sequoia 15.3, Sonoma 14.7.3, and Ventura 13.7.3. Apple has released fixed builds beginning with those versions; any system running an older release remains exposed.

The CVSS vector assigns a score of 7.7, classifying the issue as high severity, but the EPSS score is below 1 %, indicating that exploitation is currently unlikely. The vulnerability is not listed in CISA's KEV catalog, and no public exploits have been documented. It is inferred that the attack vector is local, possibly through a user‑initiated installation or a malicious background process that requests and then ignores the OAuth‑style privacy dialog.