XARA

XARA (Cross-App Resource Access) is a class of vulnerabilities that allows malicious applications to gain unauthorized access to resources belonging to other applications running on the same operating system. First extensively documented in 2015 by researchers at Indiana University, Georgia Tech, and Peking University, XARA vulnerabilities represent significant security threats to modern sandboxed computing environments, particularly on macOS, iOS; similar inter-app vulnerabilities have also been identified on Android.

XARA attacks exploit weaknesses in inter-process communication mechanisms and access control policies, enabling attackers to bypass the principle of least privilege in sandboxed applications. Examples include unauthorized access to keychain items, URL scheme hijacking, WebSocket hijacking, and app container cracking. These vulnerabilities can lead to theft of authentication credentials and personal data without requiring privilege escalation or jailbreaking.

The 2015 XARA disclosure prompted security enhancements in major operating systems, such as stricter sandbox controls on macOS and iOS. However, new variants continue to emerge as application ecosystems become more complex and interconnected.