Silent Replacement of Trusted macOS App Executables | Mysk Blog – In-Depth Cybersecurity & Mobile App Privacy Research

Silent Replacement of Trusted macOS App Executables

2026-07-23by

Talal Haj Bakry<br>and

Tommy Mysk

A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges. As a result, trusted applications can be made to execute attacker-controlled code without triggering security warnings when relaunched. Apple assessed the reported behaviour as not requiring a security fix.

Table of Contents

Like our research? Try Psylo.

Psylo is our privacy-first browser for iOS and iPadOS, with a built-in proxy network, per-tab isolated web sessions, and anti-fingerprinting. Using it helps fund more work like this.

Read why we built it &rarr;

Download Psylo &rarr;

Affected Platforms#

macOS Tahoe 26.0.0 – 26.5.2

macOS Golden Gate 27 beta 1, 2, 3, and 4

Earlier versions of macOS are likely affected as well, but have not been tested.

Summary#

macOS provides several safeguards to prevent applications and scripts from tampering with other installed applications. In this post, we show a bug in macOS that allows an attacker to:

Silently replace an application&rsquo;s main executable under /Contents/MacOS/ without triggering an authorization prompt.

Relaunch the modified application normally, without displaying any security warnings.

Impersonate the trusted application in system permission prompts to request access to Keychain secrets and files protected by Transparency, Consent, and Control (TCC), including those inside ~/Desktop and ~/Documents.

The attack requires only code execution as the current user, and does not require elevated privileges.

Summary for Non-Technical Readers#

We found a macOS security issue that Apple looked into but decided not to fix. If you run a malicious app or script on your Mac, an attacker could:

Secretly replace trusted apps you already have installed from the web with malicious versions.

Request permissions to access private data on behalf of those trusted apps, including files in places you expect to be private, such as your Desktop or Documents folders, or your Keychain.

Replacing a trusted app requires neither your Mac&rsquo;s password nor any special approval, and it can happen entirely in the background. Accessing protected data still requires your approval, but the macOS system prompts show the trusted app&rsquo;s name and icon, making the requests appear to come from the real app.

Background#

macOS Application Bundles#

On macOS, apps are distributed as application bundles , which are directory structures that appear as a single .app file in Finder. An application bundle contains the app&rsquo;s executable, resources such as icons and artwork, embedded frameworks and libraries, and metadata. Apple&rsquo;s documentation describes the bundle format in more detail.

When a user downloads an app from the Internet and launches it for the first time, macOS verifies its code signature and notarization and applies Gatekeeper policies to determine whether the app is trusted to run.

macOS verifying the integrity and notarization of an application before its first launch.

After the app is installed (for example, by dragging it into /Applications) and opened, macOS also protects the contents of its bundle. Other applications and scripts, even those running with administrator privileges, cannot modify files inside it. macOS blocks any such attempt and alerts the user that it prevented the modification.

macOS alerts the user when an application or script attempts to modify the contents of another application's bundle.

Archive and Restore#

We accidentally discovered a scenario in which any application or script running with the current user&rsquo;s privileges can silently replace the main executable of an application bundle and launch the modified application without triggering a code-signature or security warning.

The issue is reproducible when:

The app was downloaded from the web rather than installed through the Mac App Store. App Store apps are owned by root, while apps downloaded from the web are typically owned by the current user.

The app has already been launched at least once, allowing Gatekeeper to complete its initial verification.

The attacker already has code execution as the current user, for example through a malicious app or downloaded script.

We&rsquo;ll use Signal as an example. To be clear, this is not a Signal vulnerability. Signal is simply a convenient demonstration target because it is widely trusted and distributed outside the Mac App Store. The same behaviour affects other apps downloaded from the web, including Brave Browser, Cursor, Mullvad Browser, Proton Mail, Slack, Visual Studio Code, Xcode, and many others.

After installing Signal and launching it once, macOS prevents subsequent modifications to its application bundle. You can...