Oracle VirtualBox
Oracle VirtualBox runs other operating systems, such as Windows or Linux, in virtual computers on your Mac. It’s made by Oracle, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from oracle.com.
What it is
VirtualBox creates virtual machines, which act as separate computers inside your Mac. People use them to run another operating system, use older software or test programs.
It stores virtual disks and settings on your Mac. Shared folders let the virtual machine access files you choose to share. Clipboard sharing can expose copied text, including sensitive information. Camera, microphone and USB access let programs inside the virtual machine use those devices.
It is an established Oracle app with a clear purpose. Oracle publishes security fixes and recommends installing them promptly. Its update check sends Oracle your IP address, app version and platform information.
Who makes it
Oracle is a US database, business software and cloud computing company founded in 1977. Its legal name is Oracle Corporation. Its website is oracle.com.
Oracle makes other software with flaws that attackers have used. Its page in Companies lists them.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Oracle VirtualBox. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is org.virtualbox.app.VirtualBox or org.virtualbox.app.VirtualBoxVM. Download it only from oracle.com, not from an ad or a link someone sends you.
Fakes. In November 2026, Microsoft reported deceptive Windows installers that silently installed VirtualBox alongside CharityEngine and BOINC to use the computer's processing power.
What it connects to
In normal use, Oracle VirtualBox talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
update.virtualbox.org | Checks for new versions. |
download.virtualbox.org | Downloads installation files and additional components. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Input Monitoring | May be requested to capture keyboard input for the virtual machine. |
| Accessibility | May be requested to send keystrokes to the virtual machine. |
| Microphone | Lets programs inside a virtual machine record audio from the Mac. |
| Camera | Lets programs inside a virtual machine use the Mac's webcam. |
Security record
Problems with Oracle VirtualBox or Oracle in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Oracle patched serious flaws affecting VirtualBox 7.2.20, including CVE-2026-101598, which could let a local attacker take over the program. | ↗ | |
| Oracle patched CVE-2026-87277 in VirtualBox 7.2.16, which could let an unauthenticated attacker crash the program through its remote desktop service. | ↗ |
References
- Oracle VirtualBox: About Oracle VirtualBox docs.oracle.com
- VirtualBox source: macOS bundle identifiers and device entitlements raw.githubusercontent.com
- About Oracle oracle.com
- Oracle: United States Field Offices oracle.com
- Oracle VirtualBox: Security Guide docs.oracle.com
- Oracle VirtualBox: Privacy Information docs.oracle.com
- Oracle VirtualBox Downloads oracle.com
- Oracle VirtualBox: Change Log docs.oracle.com
- VirtualBox source: Update agent raw.githubusercontent.com
- Netify: VirtualBox domains netify.ai
- AppleInsider: Using VirtualBox on Apple Silicon Macs appleinsider.com
- Microsoft: Fake-download campaign uses trojanized installers to deliver monetization payloads microsoft.com
- Oracle Critical Patch Update: October 2026 oracle.com
- Oracle October 2026: Detailed vulnerability descriptions oracle.com
- Oracle Critical Security Patch Update: September 2026 oracle.com