A permissions flaw in macOS Tahoe allows applications to capture keystrokes without explicit user approval, effectively enabling keylogging. This flaw affords an attacker the ability to harvest typed data and sensitive credentials, thereby violating user privacy. The underlying weakness is an access control defect, identified as CWE‑284, which permits privileged data collection under the guise of legitimate input handling.

The vulnerability exists in macOS Tahoe installations prior to the 26.3 firmware update. Apple has released a patch in macOS Tahoe 26.3 that implements additional restrictions on keystroke monitoring. Users running earlier Tahoe releases, or those that have not applied the latest security update, are susceptible.

The CVSS score of 3.3 classifies the risk as moderate, and the EPSS score of less than 1 % indicates low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread or recent exploitation reports. Based on the description, the likely attack vector is a malicious application that either self‑installs or is installed by a user without proper scrutiny, exploiting the permissive monitoring permissions to gather keystrokes unnoticed.