🕵️ RESEARCH & DEEP DIVES
- CDC-ACM serial interface bypasses TCC on macOS, exfiltrating secrets in 24 seconds
A researcher disclosed that macOS CDC-ACM serial device nodes bypass TCC, enabling silent credential exfiltration via a USB composite device, after Apple declined the report.- Applies to macOS 26.4.1 (Apple Silicon, tested); any Mac that has approved a USB hub, dock, or adapter is exposed.
- The /dev/cu.usbmodem* CDC-ACM serial node is read/write by any process with no TCC prompt or entitlement; TCC does not cover serial devices.
- A ~$20 ESP32-S3 composite device pairs a HID keyboard interface (types commands into Terminal) with the CDC-ACM interface (delivers scripts and exfiltrates output).
- Chained attack exfiltrates SSH private keys, AWS/GCP/Azure/Kubernetes credentials, keychain metadata, and environment secrets in 24 seconds with no consent prompts.
- On a locked Mac with Lockdown Mode, a composite device plugged into a previously trusted hub enumerates without re-prompting, bypassing USB Restricted Mode; Apple (case OE11057041574014) declined the report on 2026-05-20.
📋 ADVISORIES
- 📄 Source for Cloudflare Patches Cross-Tenant Data Leak in Containers Storage Layer — accomplish.ai
🔓 CVEs & KEV
- CVE-2026-53493 — containerd — CVSS 6.9 — Containerd has image-pull DoS via crafted OCI index graph amplificationcontai...