CoreGraphics in Apple Mac OS X before 10.9 allows local users to bypass secure input mode and log an arbitrary application's keystrokes via a hotkey event registration.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-5011
http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html