Apple macOS · Disclosed

Researcher announces zero-day that bypasses macOS Gatekeeper

Oct 27, 2026 · 1 min read

Researcher @mufeedvh announced on social media the zero-day CVE-2026-112512 in macOS. According to the claim, the bypass defeats Gatekeeper checks on any app, keeps the quarantine bit intact, requires no extra user interaction, and passes the Safari download flow. No fix or technical details are public and a write-up was promised, so avoid opening apps from unknown sources until Apple responds.

By HIFY Radar newsroom Updated 10/27/2026 02:08 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher announced on social media a macOS zero-day cited as CVE-2026-112512. According to him, the flaw bypasses Gatekeeper, the protection that blocks unverified apps, on any app and with no extra user action. Apple has not responded and no fix has been disclosed.

Why it matters

If confirmed, malicious apps could open on Macs without any warning, even when downloaded through Safari, opening the door to malware and data theft. Any company with employees on macOS is potentially exposed, and no fix is available right now.

What to do

Reinforce the policy of installing apps only from trusted sources and the App Store. Use Mac management tools to restrict execution of apps from unauthorized origins. Watch for Apple's statement and apply the update as soon as it ships.

For the technical team

CVE: CVE-2026-112512
Affected: Apple macOS (Gatekeeper) · Apple macOS (Gatekeeper). Specific versions not stated in the source.
Exploitation: No exploitation reported and no public PoC. Only the announcement by researcher @mufeedvh on social media, on 2026-10-27, citing CVE-2026-112512. A technical write-up was promised.
Fix: No fix disclosed. Apple's position unknown.
Vector: Gatekeeper bypass in macOS. Per the researcher, it applies to any app, requires the quarantine bit to stay intact, needs no extra user interaction, and passes the Safari download flow. Technical details of the vector are not yet public.
More details: The researcher claims the method checks off all criteria for a complete Gatekeeper bypass and that, per him, Apple pays $100K for this class of flaw. The original post is the only source; nothing has been independently verified.