Sploitlight - Exploiting Spotlight to Bypass TCC on macOS

Discover a critical macOS security vulnerability in this 43-minute conference talk that exposes how Spotlight plugins can be exploited to bypass Apple's Transparency, Consent, and Control (TCC) privacy protections. Learn about CVE-2025-31199, a novel TCC bypass technique that allows unauthorized access to sensitive user data through Spotlight's indexing mechanism. Follow the complete discovery process from initial research to exploitation methodology, understanding how this vulnerability highlights significant gaps in Apple's privacy infrastructure. Explore the intersection of this bypass with Apple Intelligence, examining how the AI system handles private data including database file access, sensitive content querying, and behavior across multi-user systems. Understand how a single TCC bypass can expose sensitive information both locally and remotely, creating broader security implications. Gain insights into the responsible disclosure process with Apple and examine the technical details of the exploitation technique. Conclude with practical recommendations for hardening Apple's privacy infrastructure and implementing mitigations against similar threats, presented by Microsoft Senior Security Researcher Christine Fossaceca and security researcher Jonathan Bar Or at Objective-By-The-Sea v8.0.