CVE-2020-9977: 
macOS vulnerability analysis and mitigation

A validation issue existed in the entitlement verification in Safari that affected macOS Big Sur 11.0.1, iOS 14.0, and iPadOS 14.0. The vulnerability was discovered by Josh Parnham (@joshparnham) and was fixed in the respective OS versions (Apple Support, Apple Support).

The vulnerability was caused by improper validation of process entitlements in Safari. The issue was addressed with improved validation of the process entitlement. The vulnerability has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, and a CVSS v2.0 Base Score of 4.3 (MEDIUM) with a vector of (AV:N/AC:M/Au:N/C:P/I:N/A:N) (NVD).

A malicious application may be able to determine a user's open tabs in Safari, potentially leading to privacy violations and information disclosure (Apple Support).

The vulnerability requires local access and user interaction to be exploited. There are no public reports of this vulnerability being exploited in the wild (NVD).

The vulnerability was patched in macOS Big Sur 11.0.1, iOS 14.0, and iPadOS 14.0. Users should update their systems to these versions or later to mitigate the vulnerability (Apple Support, Apple Support).