macOS Flaw Allows TCC Bypass, Exposing Sensitive User Information

Researchers disclosed CVE-2025-43530, a critical TCC bypass in macOS ScreenReader.framework (com.Apple.scrod) that lets local attackers execute arbitrary AppleScript and send AppleEvents to protected processes by abusing flawed trust checks (accepting any Apple-signed binary and using SecStaticCodeCreateWithPath, creating a TOCTOU opportunity); multiple MIG routines share the same logic and Apple patched the issue in macOS 26.2 by requiring a specific entitlement and using the client's audit token.