Hijacking Apps Using Archive Utility

Talal Haj Bakry and Tommy Mysk (Mastodon): Until macOS 26.4, Archive Utility had nearly unrestricted filesystem access. Combined with a drag-and-drop sandbox quirk, this let an attacker bypass App Sandbox data containers, Transparency, Consent, and Control (TCC) protections, and hijack third-party apps — all without special permissions or elevated privileges. […] Here’s one interesting aspect […]