User level: Level 1 (12 points)After I upgraded to macOS 27 an app called "WidgetRender_activities" shows black windows (getting more and more if you don't quit) on my Mac. It can't be closed from dock and needs to be quitted from Activity Monitor. The app's route in my Mac is /System/Library/CoreServices/WidgetRenderer_Activities.app. Has my Mac been hacked?
MacBook Air M5 16GB RAM 512GB SSD
[Edited by Moderator]
Posted on Sep 24, 2026 5:24 AM
User level: Level 9 (72,871 points)Sep 24, 2026 6:42 AM in response to RemyPeng
No, your Mac has not been hacked.
The path /System/Library/CoreServices/WidgetRenderer_Activities.app confirms that this is a legitimate, core system file built by Apple. It is a system service responsible for rendering Live Activities and dynamic widgets on your desktop and notification center.
The behavior you are seeing has been reported in macOS 27. Apparently, a glitch causes WidgetRenderer_Activities to spawn multiple un-closable, empty black windows — especially after waking the computer from sleep.
Because it is an essential macOS background process, you cannot quit it from the Dock, but you can manage it using this workarounds to temporarily clean up your screen:
Clear Third-Party Widgets: The bug is often triggered by an incompatible iPhone app or third-party desktop widget trying to sync a Live Activity to your Mac. Right-click and remove any recently added or inactive widgets from your desktop or Notification Center.
It might help to see if the problem is present when you boot in safe mode: That process performs some system cleanup and clears caches, and also disables 3rd party extensions that may cause problems.
Start up your Mac in safe mode - Apple Support
Bugs can be reported to Apple here:
User level: Level 10 (123,805 points)Sep 24, 2026 7:22 AM in response to RemyPeng
The path: /System/Library/CoreServices/WidgetRenderer_Activities.app
It places the application on the macOS system volume, which is protected by the Signed System Volume (SSV) security mechanism.
As Apple's documentation explains, the sealed system volume is cryptographically sealed, and macOS verifies its integrity during startup.
The volume is mounted read-only during normal operation.
Apple Platform Security: Signed system volume security
What this means for your concern about hacking:
A conventional third-party application cannot ordinarily modify or replace this application on the sealed system volume.
Its location is strong evidence that it is a macOS-provided component, assuming the path is genuine and the system volume's seal is intact.
The black windows and accumulating processes are more consistent with a software defect, rendering problem, or process-management issue than with evidence of an external compromise.
There is one important distinction: the system volume's protection does not prove that the entire Mac is uncompromised. Malware could potentially run elsewhere, exploit a vulnerability, or operate through other mechanisms. Nor does the path alone establish that the running process is authentic.
Conclusion: Given the exact system path and the reported symptoms following your macOS 27 upgrade, I would investigate this first as a macOS system-component bug.
There is no evidence in the information provided that your MacBook Air M5 has been hacked.
Originally posted at discussions.apple.com/thread/256364083