macOS Vulnerability Exposed Sensitive Data, Including Keychain and iOS App Binaries

At Nullcon Berlin 2025, security researcher Koh M. Nakagawa revealed a significant vulnerability in macOS 15.0 (Sequoia) that allowed attackers to access sensitive data, including the login Keychain and encrypted iOS app binaries. The issue stemmed from a misconfiguration where Apple’s /usr/bin/gcore utility was granted an entitlement to read the memory of any process on the system, even with System Integrity Protection (SIP) enabled. This entitlement, which Apple removed in macOS 15.3, allowed gcore to dump memory from protected processes. The attack could bypass security mechanisms like Transparency, Consent, and Control (TCC), enabling attackers to extract files opened by sandboxed apps, such as PDFs or contact data. Additionally, attackers could decrypt the login Keychain without requiring the user’s password by retrieving the Master Key from memory dumps. Nakagawa also demonstrated that gcore could be used to extract decrypted versions of FairPlay-encrypted iOS app binaries running natively on Apple Silicon Macs. Apple has since addressed the issue in macOS 15.3, and the vulnerability can be detected through the Endpoint Security Framework. This event highlights the risks of misconfigured entitlements and the potential for similar vulnerabilities in other system tools.