Apple’s macOS High Sierra, which was released to the public today, contains a vulnerability that lets apps discover Keychain passwords in plaintext.
According to Synack research director Patrick Wardle, the vulnerability requires victims to intentionally override built-in security. Wardle was able to leverage the vulnerability to steal logins for websites like Facebook and Bank of America.
Wardle said that the exploit works as long as a person is logged in, and doesn’t require root access. The concept app does however demand that people download, install, and run it while deliberately overriding macOS security settings, including warnings about trusting unsigned software.
Apple has not yet responded to requests for comment about the potential vulnerability.