CVE-2026-20601: 
macOS vulnerability analysis and mitigation

CVE-2026-20601 is a permissions issue in the Foundation framework of Apple macOS Tahoe that allows a locally installed app to monitor keystrokes without user permission. The vulnerability was disclosed by Apple on February 11, 2026, and was reported by an anonymous researcher. It affects macOS Tahoe versions prior to 26.3. The CVSS v3.1 base score is 3.3 (Low) (Apple Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and stems from insufficient permission restrictions within Apple's Foundation framework. Apple addressed the issue by applying additional restrictions to the affected permissions handling code. An attacker must have a locally installed app running with low privileges to exploit this flaw — no user interaction or elevated privileges are required, but the attack is limited to the local system (Apple Advisory).

Successful exploitation allows a malicious app to silently monitor keystrokes entered by the user without requesting or receiving explicit user permission, posing a confidentiality risk. This could expose sensitive data such as passwords, messages, and other typed content. There is no integrity or availability impact associated with this vulnerability (Apple Advisory).

Apple addressed CVE-2026-20601 in macOS Tahoe 26.3, released February 11, 2026, by applying additional restrictions to the vulnerable permissions handling in the Foundation framework. Users and administrators should update to macOS Tahoe 26.3 or later as soon as possible. No configuration-based workarounds have been published by Apple (Apple Advisory).

The vulnerability was noted in the SANS Internet Storm Center diary entry shortly after disclosure, as part of broader coverage of Apple's February 2026 security updates. No significant independent researcher commentary or media coverage specific to this CVE has been identified, consistent with its low severity rating (Apple Advisory).