CVE-2023-44077: Critical Signature Flaw in SNS ShareBrowser

CVE-2023-44077 is a critical (CVSS 9.8) signature verification flaw in Studio Network Solutions ShareBrowser before 7.0 on macOS. A researcher's write up says launch services accepted connections without checking who was calling. Version 7.0 and later address it, so update.

What's affected

The record names ShareBrowser before 7.0 on macOS. The researcher's write up says ShareBrowser 6.1.5.27 and older are affected and that version 7.0 and newer contain the fix. The vendor's release notes page for version 7.0 was not readable when we tried it, so we rely on the researcher for the version detail.

Here the sources differ on severity. The record scores the flaw 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which implies a network attack with no privileges. The write up describes a local problem: launch daemons, some running as root, exposed XPC services whose connection handlers did not validate the calling process, so any local process could use their privileges. That reads as local privilege escalation, which would usually score lower than 9.8. We report both and recommend you act on the fix either way.

The weakness is CWE-347, improper verification of a cryptographic signature. The record does not mark the CVE as known exploited.

How to check if you're exposed

1. On each Mac, open the ShareBrowser app, choose About ShareBrowser from the menu, and read the version.
2. Anything below 7.0 is in scope.
3. List launch daemons the product installed. In Terminal, ls /Library/LaunchDaemons | grep -i sns shows helper entries from Studio Network Solutions.
4. Use your mobile device management inventory to find ShareBrowser across the fleet.

Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.

What to do now

1. Update ShareBrowser to version 7.0 or later.
2. After updating, confirm that old helper launch daemons are gone. The researcher says only one launch service remains in 7.0, and it checks callers by code signature.
3. Limit who has local accounts on Macs that run ShareBrowser, since the described weakness is a local one.
4. Add ShareBrowser to your software inventory so versions are tracked.
5. Watch Studio Network Solutions' release notes for future security fixes.

Why it matters

Apple's XPC lets helper programs offer services to other processes. A helper running as root must check who is connecting, and the standard way is to verify the caller's code signature. According to the researcher, the vulnerable helpers did not, so any local process could ask them to act with their rights.

The researcher also reports that version 7.0 was released on 3 January 2024 without notice to the reporters, and the CVE was published on 17 January 2024. Treat their opinions of the vendor as theirs. The practical lesson is that privileged helpers need caller checks, and teams that ship them should test for that.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Researcher write up (khronokernel.com)
• Vendor release notes for 7.0 (record reference, not readable when fetched)

Last reviewed: 19 October 2026.