CVE-2026-20622: 
macOS vulnerability analysis and mitigation

CVE-2026-20622 is a privacy vulnerability in the Shortcuts component of Apple macOS that allows a malicious app to capture a user's screen without authorization. The root cause is improper handling of temporary files (CWE-284: Improper Access Control). It affects macOS Sequoia versions 15.0 through 15.7.4 (exclusive) and macOS Tahoe versions 26.0 through 26.3 (exclusive). Apple disclosed and patched the vulnerability on February 11, 2026, with the advisory entry added March 24, 2026. The Feedly-estimated CVSS v3.1 base score is 7.5 (High), though Apple has not published an official CVSS score (Apple Advisory 126348, Apple Advisory 126349).

The vulnerability is classified under CWE-284 (Improper Access Control) and stems from insecure handling of temporary files within the macOS Shortcuts subsystem. An app running on the affected system can exploit this flaw to access temporary files created during screen capture operations, effectively allowing unauthorized screen capture without user consent or the required privacy permissions. The fix was implemented by improving how temporary files are handled to prevent unauthorized access by other applications. The vulnerability was discovered and reported by Csaba Fitzl (@theevilbit) of Iru (Apple Advisory 126348, Apple Advisory 126349).

Successful exploitation allows a malicious application to silently capture a user's screen, resulting in a significant confidentiality breach. Sensitive information visible on screen — including credentials, private communications, financial data, or other personal content — could be exposed to the attacker. There is no reported impact on system integrity or availability, but the screen capture capability could facilitate further attacks such as credential harvesting or targeted surveillance (Apple Advisory 126348, Apple Advisory 126349).

Apple has released patches addressing this vulnerability in macOS Sequoia 15.7.4 and macOS Tahoe 26.3, both released on February 11, 2026. Users should update their macOS installations to these versions or later as the primary remediation. No configuration-based workarounds have been published by Apple. Users can also review and restrict app permissions for screen recording via System Settings > Privacy & Security > Screen Recording to limit exposure (Apple Advisory 126348, Apple Advisory 126349).