macOS CVE Tracker 2025-2026
Actively Exploited Zero-Days & Critical Vulnerabilities
A live tracker of real macOS CVEs from 2025 and 2026 — focusing on vulnerabilities that are actively exploited in the wild, listed in CISA's Known Exploited Vulnerabilities catalog, or part of major exploit campaigns like DarkSword. All data sourced from CISA KEV, Apple Security Updates, and NVD. Updated after each Apple security release.
macOS System Settings > Software Update is your first line of defense. Verify your Mac is running the latest security update for your OS version.
The DarkSword exploit chain — 6 vulnerabilities chained from a single web visit to full kernel compromise, bypassing Apple's PAC and TPRO hardware security.
The DarkSword Exploit Campaign
On March 18, 2026, Google Threat Intelligence Group (GTIG), iVerify, and Lookout jointly disclosed DarkSword — a full-chain exploit kit that chains six vulnerabilities (three of them zero-days) to achieve complete device compromise. The entire attack is implemented in JavaScript, executing within Safari's browser engine without requiring any app installation. It bypasses Apple's Pointer Authentication Codes (PAC) and Trusted Page Reference Owner (TPRO) — two of Apple's primary kernel integrity controls.
Attribution & Scope
Attributed to Russian-linked threat actors targeting Ukrainian users via watering hole attacks on compromised legitimate websites. iVerify estimated up to 270 million iPhones remained on vulnerable iOS versions at the time of disclosure.
Relevance to macOS: CVE-2025-43529 and CVE-2026-20700 directly affect macOS Tahoe. CVE-2025-14174 affects Chrome and Electron apps on macOS. Mac users who visited compromised websites were potential targets.
The 6-CVE Exploit Chain
- 1. CVE-2025-31277 — JavaScriptCore memory corruption (initial access, not zero-day)
- 2. CVE-2025-43529 — JavaScriptCore UAF (alternative initial access, zero-day)
- 3. CVE-2026-20700 — dyld PAC/TPRO bypass (Stage 2, zero-day)
- 4. CVE-2025-14174 — ANGLE Metal OOB write (sandbox escape, zero-day)
- 5. CVE-2025-43510 — iOS kernel memory management (privilege escalation)
- 6. CVE-2025-43520 — iOS kernel memory corruption (kernel compromise)
Attack flow: Visit compromised website → WebContent RCE → PAC bypass → Sandbox escape → Kernel R/W → Data exfiltration → Self-deleting fileless cleanup.
Why This Matters for Mac Users
DarkSword demonstrates that Apple's hardware-enforced security controls — PAC and TPRO — are bypassable with the right exploit chain. While the full chain was primarily targeting iOS, three of the six CVEs directly affect macOS. Mac users running outdated versions of Tahoe, or using Chrome/Electron apps, were within the attack surface.
Key takeaways:
- Keep macOS and Safari updated to the latest versions — the DarkSword chain was fully patched by February 2026
- Update Chrome and Electron-based apps (VS Code, Slack, Discord) regularly — CVE-2025-14174 affects them on macOS
- Be cautious when visiting unfamiliar websites, especially those related to conflict zones — watering hole attacks target specific communities
- Enable Lockdown Mode if you are at elevated risk (journalists, activists, government personnel)
- Don't assume Apple's hardware security (PAC/TPRO) makes you immune — DarkSword proved both are bypassable
Disclaimer: This tracker is compiled from public sources including CISA KEV, Apple Security Updates, NVD, Google Threat Intelligence Group, iVerify, Lookout, and security vendor blogs. Patch status changes rapidly — always verify against the Apple Security Updates page and CISA KEV catalog for the latest status. Last updated: September 1, 2026.
Actively Exploited Zero-Days (Now Patched)
These macOS vulnerabilities were exploited as zero-days in the wild before patches were available. All five are listed in CISA's Known Exploited Vulnerabilities catalog. If you haven't applied the relevant Apple security updates, you are still vulnerable. Check your macOS version against the patch dates below.
macOS Screen Sharing Improper Authentication Vulnerability
A pre-authentication flaw in screensharingd's Secure Remote Password (SRP) handshake. An attacker on the network can authenticate to Screen Sharing without valid credentials and gain root-level file access. NCSC-NL confirmed active exploitation: on every internet-exposed Mac with port 5900 reachable, attackers gained root access and installed a Monero cryptocurrency miner (XMRig 6.26.0 disguised as com.apple.airportd). CISA rescored from 7.1 to 9.8 on August 14. Microsoft Security Intelligence also observed exploitation.
Update immediately. Disable Screen Sharing if not needed. Block port 5900 at firewall. Never expose Screen Sharing to the internet.
Apple dyld Pointer Authentication Code (PAC) Bypass
A memory corruption vulnerability in dyld, Apple's dynamic linker — the first code that executes when any app launches. Allows bypass of both Pointer Authentication Codes (PAC) and Trusted Page Reference Owner (TPRO), Apple's two primary hardware-enforced kernel integrity controls. Served as Stage 2 of the DarkSword exploit chain. The vulnerability reportedly existed in dyld's code path for nearly two decades. Discovered by Google GTIG.
Update to macOS Tahoe 26.3 or later.
Apple WebKit Use-After-Free Vulnerability (JavaScriptCore DFG JIT)
A use-after-free in JavaScriptCore's DFG JIT compiler — a missing write barrier leads to GC freeing live objects. Processing maliciously crafted web content leads to arbitrary code execution. Apple confirmed exploitation in "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 26. Discovered by Google Threat Analysis Group (GTIG). Part of the DarkSword exploit chain.
Update to macOS Tahoe 26.2 or later. Safari 26.2 or later.
ANGLE Metal Staging Buffer Out-of-Bounds Write
An out-of-bounds write in ANGLE's Metal backend when uploading depth textures via a staging buffer. The staging buffer size uses GL_UNPACK_IMAGE_HEIGHT instead of actual texture height, causing GPU memory corruption. Served as the WebContent sandbox escape in the DarkSword exploit chain. Cross-browser: affects Chrome, Edge, and Electron apps on macOS (not macOS Safari, which uses native Metal WebGL). Discovered by Apple SEAR + Google GTIG.
Update Chrome to 143.0.7499.110+. Update Electron-based apps.
Apple ImageIO Out-of-Bounds Write Vulnerability (DNG/JPEG-Lossless)
An out-of-bounds write in Apple's Image I/O / RawCamera image processing code. A crafted DNG/JPEG-lossless image triggers a buffer overwrite when TIFF metadata (SamplesPerPixel) disagrees with JPEG SOF3 component count. Exploitable via iMessage, Mail, Safari — any app that processes images. Apple confirmed exploitation in "extremely sophisticated attack against specific targeted individuals." Similar ImageIO bugs have been used in Pegasus spyware campaigns.
Update to macOS Sequoia 15.6.1, Sonoma 14.7.8, or Ventura 13.7.8.
Other Notable macOS Vulnerabilities (Patched)
These macOS vulnerabilities were patched by Apple but have not been confirmed as exploited in the wild. They are included because of their severity — kernel code execution and privilege escalation flaws that demand immediate patching even without active exploitation evidence.
macOS Screen Sharing Legacy VNC File-Copy Privilege Escalation
A logic flaw in Screen Sharing's file-transfer helpers (SSFileCopySender and SSFileCopyReceiver). When legacy VNC password authentication is used, these helpers run with root privileges instead of dropping to the authenticated user's context. An attacker with the VNC password can read any file as root and write root-owned files to privileged locations — enabling remote root command execution. Discovered by bynar.io.
Update to latest macOS. Disable legacy VNC password authentication in Remote Management settings.
macOS Wi-Fi Kernel Code Execution Vulnerability
"An app may be able to execute arbitrary code with kernel privileges." Affects all three macOS versions (Tahoe, Sequoia, Sonoma). One of the most severe CVEs in the May 2026 Apple security update — kernel code execution via the Wi-Fi subsystem.
Update to macOS Tahoe 26.5, Sequoia 15.7.7, or Sonoma 14.8.7.
macOS Kernel Out-of-Bounds Write Vulnerability
"An app may be able to cause unexpected system termination or write kernel memory." An out-of-bounds write directly into kernel memory on all three macOS versions. Kernel memory writes can lead to privilege escalation and full system compromise.
Update to latest macOS.
Worried About Your Mac Exposure?
With 5 actively exploited zero-days and a full-chain exploit kit targeting macOS users, Apple security in 2026 requires active defense — not just "Macs don't get viruses." I can audit your Mac systems, apply security hardening, verify Screen Sharing is not exposed, and help you enable Lockdown Mode if you're at elevated risk.