TLDR Tech / InfoSec
Crossing the Golden Gate: macOS's New Application Support Protection
Wojciech Reguła uncovered an undocumented macOS 27 privacy feature that extends the `com.apple.macl` extended attribute to protect `~/Library/Application Support` folders for a hardcoded allowlist of non-sandboxed applications, including popular browsers and crypto wallets. This mechanism, enforced by the kernel MACL under `kTCCServiceSystemPolicyAppDataDetailed`, prevents unauthorized writes to these paths, even for uninstalled apps, while ensuring browser extensions function. This significantly hinders credential-theft attempts targeting listed applications, as the allowlist is dynamically updated via XProtect, though other applications remain vulnerable.
Read the full story