A researcher discovered two serious vulnerabilities in macOS Recovery Mode's Safari browser that allowed unauthorized access to system partitions. The first flaw (CVSS 8.5) enabled arbitrary writes to system partitions and root persistence, while the second (CVSS 4.6) permitted unrestricted file reads. Both vulnerabilities were found in macOS Sequoia and older versions.

Recovery Mode Safari unexpectedly allowed users to connect to WiFi and browse the internet, contrary to its intended purpose as a system repair tool. The researcher discovered that by manipulating Safari's download settings and using custom HTTP headers, they could save files directly to protected system directories like /Library/LaunchDaemons. This enabled the creation of malicious launch daemons that executed with root privileges after reboot.

The second vulnerability persisted in macOS Tahoe 26.0, where Apple replaced Safari with a locked-down "Web Browser" that still allowed file access through the Open File dialog. This meant attackers could view sensitive system files including configuration files, PDFs, and images. Apple has since patched these vulnerabilities, but the incident highlights the security risks of including full browser functionality in recovery environments.