Parallels Desktop
Parallels Desktop runs Windows, Linux and other operating systems alongside macOS, so you can use their apps on your Mac. It’s made by Parallels, based in Switzerland.
Criminals have used its name in fake downloads or scams, so get it only from parallels.com.
What it is
People use Parallels Desktop to run Windows apps for work, school and games without restarting their Mac. It creates a virtual machine: a separate operating system running inside an app.
It can share Mac files, the clipboard and connected devices with Windows. Folder permissions let it open virtual machines and let Windows apps read and save Mac files. Camera and microphone access let those devices work inside the virtual machine.
Microsoft authorises Parallels Desktop to run Windows 11 Pro and Enterprise on Apple silicon Macs. Parallels recommends keeping the app, macOS and Windows updated, as each affects the security of the virtual machine.
Who makes it
Parallels makes virtualisation and remote access software, is based in Switzerland and is part of Alludo. Its legal name is Parallels International GmbH. Its website is parallels.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real Parallels Desktop is signed by Parallels, Apple team ID 4C6364ACXT, or by the App Store for copies installed from there. A copy signed by anyone else isn’t from Parallels. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/Parallels Desktop.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is com.parallels.desktop.console or com.parallels.desktop.appstore. Download it only from parallels.com or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In May 2021, Jamf found XCSSET malware checking Parallels Desktop among apps whose existing screen-recording permission it could abuse to take screenshots without another prompt. Apple fixed the underlying macOS flaw in Big Sur 11.4.
What it connects to
In normal use, Parallels Desktop talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
desktop.parallels.com | Licence checks. |
license.parallels.com | Product activation. |
account.parallels.com | Account management. |
reportus.parallels.com | Technical data reports. |
support.parallels.com | Sending feedback. |
www.parallels.com | Help, documentation and support. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Files and Folders | Access virtual machines and installation images, and let Windows apps open and save files in permitted Mac folders. |
| Full Disk Access | Open files in virtual machine apps and save files, Windows installation images and product updates in protected Mac folders. |
| Accessibility | Control keyboard input while using virtual machines. |
| Camera | Make the Mac camera available inside Windows or another virtual machine. |
| Microphone | Make the Mac microphone available inside Windows or another virtual machine. |
| Screen Recording | Take screenshots and record the screen. |
| Bluetooth | Share Bluetooth devices with virtual machines in versions supporting this feature; shared Bluetooth was removed in version 27. |
Security record
Problems with Parallels Desktop or Parallels in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Parallels fixed reported security flaws ZDI-CAN-30608 and ZDI-CAN-30030 in version 27.0.3, with fixes for version 26 released in 26.5.0 on 13 October. | ↗ | |
| CVE-2026-90894 let a local user gain full system control through a background service; Parallels lists fixes in versions 27.0.0 and 26.5.0. | ↗ | |
| Cisco Talos disclosed a snapshot flaw, CVE-2024-54189, that could let a local attacker overwrite files and gain higher privileges; Parallels fixed it in 20.3.0. | ↗ | |
| Researchers disclosed ways to bypass an earlier installer security fix and gain full system control; Parallels subsequently released fixes in versions 20.2.2 and 19.4.2. | ↗ | |
| CVE-2025-0413 let a local attacker abuse the Technical Data Reporter to gain full system control; Parallels fixed it in version 20.2.0 before public disclosure. | ↗ |
References
- Parallels Desktop for Mac parallels.com
- Parallels Desktop bundle identifier and signing details appcatalog.cloud
- Wazuh issue containing the App Store edition's Info.plist github.com
- About Parallels parallels.com
- Parallels contact details and Swiss headquarters parallels.com
- Parallels announcement identifying it as part of Alludo parallels.com
- Parallels Desktop trial download parallels.com
- Parallels Desktop on the Australian Mac App Store apps.apple.com
- Check for available updates in Parallels Desktop for Mac kb.parallels.com
- Parallels Desktop 27 updates summary kb.parallels.com
- Communication Ports and Hosts for Parallels Desktop for Mac kb.parallels.com
- Install Parallels Desktop for Mac kb.parallels.com
- Why does Parallels Desktop need access to macOS documents? kb.parallels.com
- Allow access to microphone, camera or Bluetooth for Parallels Desktop kb.parallels.com
- How to capture screenshots and take screen recordings on your Mac parallels.com
- Zero-Day TCC bypass discovered in XCSSET malware jamf.com
- Deconstructing a Zero-Day: XCSSET Malware resources.jamf.com
- Parallels Desktop Security Updates kb.parallels.com
- CVE-2026-90894 record containing JFrog's advisory vulnerability.circl.lu
- Cisco Talos snapshot privilege escalation report talosintelligence.com
- Exploits for unpatched Parallels Desktop flaw give root on Macs bleepingcomputer.com
- Parallels Desktop Technical Data Reporter privilege escalation advisory zerodayinitiative.com
- The signature on a real installed copy, read by HARD with
codesign.