Attack Chain

1. Attacker crafts a malicious URL using the iina://open scheme, embedding harmful commands within mpv_options or input-commands parameters.
2. The crafted URL is delivered to the victim, typically through a link in a website or email.
3. The victim clicks on the malicious URL, triggering a browser prompt asking for permission to open the URL with IINA.
4. The user approves the browser protocol prompt.
5. IINA receives the URL and passes the mpv_options and input-commands parameters to the mpv runtime.
6. The mpv runtime executes the attacker-supplied commands.
7. Arbitrary commands are executed on the macOS system with the privileges of the user running IINA.
8. The attacker achieves code execution, potentially leading to system compromise.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the victim’s macOS system with the privileges of the user running IINA. This can result in data theft, malware installation, or complete system compromise. The CVSS v3.1 base score for this vulnerability is 8.8, indicating a high severity.

Recommendation

• Upgrade IINA to version 1.4.3 or later to patch CVE-2026-47114.
• Deploy the Sigma rules provided below to detect potential exploitation attempts.
• Educate users to be cautious when opening URLs, especially those using custom URL schemes, and to carefully review the prompt before granting permission.
• Monitor process creation events on macOS for processes spawned by IINA with unusual command-line arguments, using the process_creation rule provided below.
• Implement network connection monitoring to detect any suspicious outbound connections originating from IINA after potential command execution.