macOS Notification Center retains Signal messages

Signal's macOS app leaves 'disappearing' message contents recoverable in the macOS Notification Center database even after they're deleted from the app's UI.

Security researcher Patrick Wardle investigated a bug reported by Alec Muffett showing that Signal's macOS desktop application fails to properly clear message content from the OS-level Notification Center database when disappearing messages expire. The root cause is that Signal posts notifications containing full message text (and even image attachments) to macOS's Notification Center, but never explicitly deletes these entries when it removes the corresponding messages from its own UI. The OS auto-dismisses the visible banner alert after a few seconds, but the underlying SQLite database record (stored at ~/Library/.../com.apple.notificationcenter/db2/db) persists indefinitely and is readable with normal user permissions.

Wardle demonstrated that these notification records — including binary property list blobs containing sender name, message body, and even embedded images — can be trivially extracted and decoded using Python's biplist module, effectively allowing recovery of 'deleted' or 'disappeared' Signal messages long after they should have been erased. This represents a privacy/information-disclosure issue rather than a remote exploit: any local user or process with read access to the filesystem could recover sensitive message content that users believed had been permanently removed.

The issue appears specific to the macOS desktop client; the iOS version was not found to exhibit the same behavior. Mitigations suggested include disabling notifications within Signal's settings or manually deleting the notification database, though the article notes uncertainty about whether removing entries truly purges message content from the underlying store.

Source reporting: https://objective-see.org/blog/blog_0x2E.html