Unit 42 identified a new macOS Tahoe 26 forensic artifact called App.MenuItem within the Apple Biome system. This artifact logs detailed user menu selections system-wide, capturing the exact text of menu items chosen and their timestamps. Stored at ~/Library/Biome/streams/restricted/App.MenuItem/local in SEGB-encapsulated protobuf format, it requires specific parsing tools such as ccl-segb. The artifact enables reconstruction of user workflows and intent by providing a narrative of interactions, such as compressing files or emptying the trash. It enhances forensic investigations by adding human context to technical logs. No exploitation or vulnerability is described; rather, this is a new data source for forensic analysis.

This artifact does not represent a security vulnerability or threat but rather a new forensic data source. It enhances the ability of investigators to understand user actions and intent on macOS Tahoe 26 systems by providing detailed logs of menu selections. There is no indication of exploitation or risk to system security. The impact is primarily positive for digital forensics and incident response.

No remediation or patch is required as this is not a vulnerability but a forensic artifact. Organizations and forensic examiners should consider incorporating the App.MenuItem artifact into their analysis workflows when investigating macOS Tahoe 26 systems. Specialized tools like ccl-segb can be used to parse the data. No security actions are necessary.