CodeColorist

How iOS 27 trims the dyld shared cache and updates stub island trampolines

Yet another LOOBins

Bypass hardware assisted mitigation using Objective-C runtime.

A simple access control issue makes a huge difference, leading to infoleak and use after free.

Remotely pwn iOS and pop up arbitrary app with 0 memory corruption.

A rogue Wi-Fi hotspot can crash your phone.

There is a turing-complete querying language embeded in Objective-C hidden in plain sight.

A funny bug chain turing inter-process XSS to native code execution for sandbox escape.

Copycat.

Triggering inter-process XSS for fun and profit.

Useless bugs are just being given up too early.

Similar to DLL sideloading, legit plugins on macOS could be abused to load executable code on startup.

Relying on pid to validate IPC peer is unsafe.

Applying web security tricks to macOS LPE bugs.

TOCTOU bug in CoreFoundation and state change of sandbox lockdown on macOS Safari, leading to easy sandbox escape.

Code signature bypass and insecure sideloading result in privilege escalation in Microsoft Office 2016 for Mac

The private API design of XPC could make it hard for 3rd-party developers to write security code.

Get some real life 0day by playing CTF challenges.

Attacking the operating system by using its own security mechanism.

Better not leave inspectable Electron instances on production.

Abuse SQLite's legit feature to turn arbitrary SQL queries into arbitrary code execution and pwn php