As cited
Copy frozen at (site build).
vulnerabilities
Meta Muse AI app flaw lets local malware redirect dictation traffic
Security researcher Patrick Wardle identified a local zero-day vulnerability in Meta's Muse macOS app that allows unprivileged local code to redirect the app's dictation traffic to an attacker-controlled endpoint. The flaw exploits an undocumented setting called endo_voyager_dictation_endpoint, potentially exposing dictated audio, prompts, and authentication material to attackers. The vulnerability requires local code execution and functions as a privilege escalation attack that bypasses macOS security controls.
Why it matters: macOS users running Muse with local malware present face exposure of their dictation input and potential abuse of the app's granted permissions; practitioners should assess whether Muse deployment in their environments introduces unacceptable risk from local threat actors.
- Source published
- First seen by Cybersecurity Tracker