CVE-2026-43696

An authorization flaw in macOS, caused by insufficient entitlement checks, allows a locally installed app to capture Touch Bar content without the user's permission. A malicious or compromised app on an affected Mac could passively read whatever is displayed on the Touch Bar — which can include predictive-text suggestions and app-specific input — making this a keystroke-adjacent privacy leak rather than a remote attack. The issue is fixed in macOS Golden Gate 27 and affects Macs with Touch Bar hardware (2016–2019 MacBook Pro models) running earlier macOS versions. Exploitation requires the attacker to already run an app on the target Mac, so the practical risk is local snooping by untrusted software. No CVSS score has been assigned yet, there is no public proof of concept, no CISA KEV entry, and no known exploitation; the fix shipped in Apple's broad September update wave.

What to do: Upgrade all Touch Bar–equipped Macs to macOS Golden Gate 27 or later, and confirm which older units are eligible for the update, since Touch Bar hardware that cannot upgrade may remain exposed. Because exploitation requires a local app, audit installed software and screen-capture/TCC permission grants on these machines. Treat unpatched Touch Bar Macs as carrying a typed-input privacy risk and avoid running untrusted apps on them.