Other Mac apps could watch your shared Safari tabs
Until the end of July, any app on your Mac could watch your shared Safari tab groups in real time: no permission request, no system prompt, nothing in the privacy settings to reveal it. Apple fixed the flaw on 27 July in Safari 26.6 and macOS Tahoe 26.6, and Positive Technologies described it publicly on 17 August. It is a small bug with a useful lesson attached, and it is worth two minutes of your evening to check that your machine already has the fix.
What a shared tab group actually is
A tab group is a named set of tabs, and Safari lets you share one with other people. Everyone in the group sees the same list, and it updates live: open a page in that group and it appears on the other person's screen within seconds. It is a genuinely useful feature for planning a trip, comparing prices with a partner or working through links with a colleague, which is exactly why the contents can be personal.
That live synchronisation is what leaked. The vulnerability, tracked as CVE-2026-43792 with a CVSS score of 6.5, sat in Safari's authorization mechanism: an application on the same Mac could subscribe to the changes in shared tab groups and watch them arrive, without the system ever asking you whether that app should have access to Safari data.
What another app could see, and what it could not
The scope matters here, and it is narrower than the headline sounds. What was exposed was the stream of changes in shared tab groups, that is the addresses appearing in groups you share with someone. Your full browsing history, saved passwords, form data and private windows were not part of it. Apple describes the impact in its usual formula: an app may be able to access sensitive user data, fixed with improved state management.
What makes it worth writing about is the missing question. On macOS you are trained to expect a dialogue box: an app wants your files, your camera, your screen, your contacts. That prompt is the entire promise of the permission model. Here there was no prompt, because the check that should have produced one was not being made. A program you installed for something completely unrelated could sit quietly and read what you and another person were opening.
The second bug: identifiers tied to your Apple account
The same researcher, credited by Apple as Ilya Andr (andrd3v) and listed in the Game Center entry as being from Positive Technologies, reported a second issue in that July round. Tracked as CVE-2026-43796 with a CVSS score of 5.5, it let an app obtain identifiers associated with your Apple account. On its own that sounds abstract, but it is the raw material for cross-app tracking: two apps from two different developers can compare notes and conclude they are looking at the same person, which is exactly what Apple's own tracking rules are supposed to prevent. That one was fixed across the whole family at once, including iOS and iPadOS 26.6, macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8.
Check it in two minutes
- Open the Apple menu, System Settings, General, Software Update. On Tahoe you want 26.6 or newer, and 26.6.1 counts. If the update is sitting there waiting, this is a good reason to install it now rather than on the weekend.
- If you stayed on Sonoma or Sequoia, the fix comes as Safari 26.6 instead. Open Safari, then the Safari menu, then About Safari, and compare the number. If it is lower, the same Software Update screen has it.
- On an iPhone or iPad, Settings, General, Software Update, and 26.6 or newer covers the account identifier issue.
- While you are in Safari, open the sidebar and look at your tab groups. The shared ones carry a participants icon. Click it and read the list of people: shared groups tend to outlive the trip or the project they were made for.
- Remove anyone who no longer belongs there, or stop sharing the group entirely. Everything you open in a shared group is visible to every participant, which is the feature working as designed and the part people forget.
What this does not mean. Nobody was reading your banking tabs: private windows and ordinary browsing were not part of this. There is no public evidence that the flaw was used against anyone before it was fixed. And neither a VPN nor private browsing would have changed anything, because the data was taken locally, on the Mac itself, and not from your connection.
Why a small bug is still worth your evening
The same macOS update closed 153 vulnerabilities in one go. Most of them will never touch you, and a few of them are the reason updates should not sit unattended for a month. A missing authorization check is not dramatic on its own, but it is the kind of gap that makes the difference between a system that asks before an app touches your data and a system that merely appears to.
The practical version is short: keep the machine on a supported version, install security updates when they land rather than when it is convenient, and once in a while look at who is still inside the things you shared.
