Sploitlight: Exploiting Spotlight to Bypass TCC on macOS

The talk looks at how Apple's TCC framework guards sensitive data such as protected folders, camera, microphone and location, and why some system binaries skip its prompts through private entitlements. The speakers focus on Spotlight, the built-in indexer that extracts searchable content from files using importer plugins. Its worker processes hold powerful TCC allowances, including full disk access, even though they are heavily sandboxed.

The researchers show that a custom importer bundle needs neither a signature nor root access to install in a user library. By invoking the built-in mdimport utility on a directory, they make Spotlight pass arbitrary protected files to their plugin, which writes the contents to the system log in small chunks for an outside process to read. Choosing the right uniform type identifier is the tricky part, and dynamic identifiers complicate targeting across machines. A recorded demo shows an unprivileged process reading files it cannot even list. The speakers then turn to Apple Intelligence, whose photo analysis caches and SQLite databases hold location, face and pet recognition data, browsing and messaging history, and similar material.

For defenders, the talk suggests hunting for mdimport calls that use the indexing flag, unsigned or ad hoc signed importer bundles in user library paths, edits to importer schemas, and dynamic type identifiers claimed by importers. Apple has since patched the issue, tracked as CVE-2025-31199, but the speakers argue that the TCC prompt remains the main barrier for much of this data and that Spotlight plugins will keep being a recurring risk.