In short: Positive Technologies researcher Ilya Andrey disclosed CVE-2026-43792 in Safari: third-party Mac apps could silently monitor open tabs in Safari's Shared Tab Groups in real time — with no permission prompts, no system alerts, no warnings whatsoever. Apple patched the flaw in Safari 26.6 and macOS Tahoe 26.6. If you haven't updated yet, your browsing activity may have been observable.
What Happened
On August 17, 2026, SecurityLab.ru published details of a vulnerability discovered by Positive Technologies researcher Ilya Andrey. The flaw was assigned CVE-2026-43792 with a CVSS score of 6.5 — moderate severity on paper, but significant from a privacy standpoint.
The core issue: any third-party app on a Mac could use a legitimate system API to observe changes in Safari's Shared Tab Groups in real time, without requesting any permissions. No "Allow App X to access Safari" dialog. No system notification. Users had no indication they were being watched.
How the Vulnerability Worked
Safari's Shared Tab Groups let multiple users view the same set of tabs. Under the hood, the feature relies on macOS notification infrastructure that allows registered apps to subscribe to system-wide events.
The authorization flaw was straightforward: Apple failed to restrict who could receive notifications about tab group changes. As a result, any installed application — even one with no declared access to Safari and no special entitlements — could subscribe to these events and receive data: which URLs were open, when tabs were added or closed. Researchers classify this as CWE-285 (improper authorization — the product fails to correctly check whether an actor is allowed to access a resource).
A companion vulnerability, CVE-2026-43796 (CVSS 5.5), affected Game Center: apps could access Apple account identifiers and track users across services without consent. Both issues were part of Apple's July–August 2026 security wave covering more than 210 CVEs.
Who Is Affected
The vulnerability affected Mac users running Safari up to version 26.5 and macOS older than Tahoe 26.6. Anyone using the Shared Tab Groups feature — especially in collaborative work or family sharing contexts — was potentially exposed.
Importantly, Shared Tab Groups is enabled by default on modern Apple devices. If you hadn't explicitly turned it off, the feature was active — and third-party apps could potentially observe your tabs. Work dashboards, banking portals, personal pages, healthcare services — any browsing activity in shared tab groups was potentially visible to rogue or compromised applications.
No active exploitation of CVE-2026-43792 has been confirmed. However, security experts note that API-level surveillance bugs are particularly dangerous because a snooping application leaves no visible trace. Reviewing installed apps and using encrypted connections are baseline measures that help reduce your overall exposure.
Apple's Response
Apple shipped patches as part of its July–August 2026 security updates:
- CVE-2026-43792: fixed in Safari 26.6 and macOS Tahoe 26.6
- CVE-2026-43796: fixed in iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6
Apple described the fix as "improved state management." Updates are available via System Settings → General → Software Update. If you're already running macOS Tahoe 26.6 and Safari 26.6, the vulnerability is already patched.
What to Do Now
Update immediately: System Settings → General → Software Update → Update Now. If automatic updates are enabled, the patch may already be installed — confirm by checking Safari → About Safari. Additionally, go to Safari Settings → Tabs → Shared Tab Groups: if you don't use the feature, disable it to minimize future exposure.
For ongoing network-level privacy, LiMP VPN encrypts your traffic and hides DNS queries from third parties — a complementary layer to keeping your system software up to date.