Researchers Detail Apple's Recent Zero-Click Shortcuts Vulnerability
![Image](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPxdOVPYTTeCnlzCgNmxUCrCVZDbo8x2q21VjHATMIVssSOyayFtO9eOLuygzc23b6gKDC1PSVH-FgXMckKcovLyxIWtDs_hXm-duOgG9CewwmVROuwA3kkkiTTPx4uKQn_pu2r7vnq2VhZ8nPsckQ1nbZXH6GclLkBlgJU4DcUINkNcqHGn21tgtmSn_r/s728-rw-e365/apple.jpg)
Details have emerged about a now-patched high-severity security flaw in Apple's Shortcuts app that could permit a shortcut to access sensitive information on the device without users' consent. The vulnerability, tracked as CVE-2024-23204 (CVSS score: 7.5), was addressed by Apple on January 22, 2024, with the release of iOS 17.3, iPadOS 17.3 , macOS Sonoma 14.3 , and watchOS 10.3 . "A shortcut may be able to use sensitive data with certain actions without prompting the user," the iPhone maker said in an advisory, stating it was fixed with "additional permissions checks." Apple Shortcuts is a scripting application that allows users to create personalized workflows (aka macros) for executing specific tasks on their devices. It comes installed by default on iOS, iPadOS, macOS, and watchOS operating systems. Bitdefender security researcher Jubaer Alnazi Jabin, who discovered and reported the Shortcuts bug, said it could be weaponized to create a malici