More Mac OS X and iPhone sandbox escapes and kernel bugs

A Project Zero deep dive into a design flaw around task_t in the XNU kernel, demonstrating sandbox escapes and privilege escalation and how each mitigation was defeated.

A Google Project Zero publication of details on Mac OS X and iPhone sandbox escape bugs after Apple shipped fixes.

Second part of Project Zero's Pixel 9 zero-click chain research: auditing the BigWave AV1 decoder driver reachable from the mediacodec sandbox and finding bugs that yield kernel read and write.

A step-by-step analysis of an in-the-wild iOS exploit that escapes Safari's WebContent process into the GPU process, covering the underlying bug and exploitation strategy.

Research on DER-encoded entitlement handling that briefly revived the Psychic Paper technique for forging iOS entitlements, covering the root cause and subsequent fixes.

Project Zero revisits Broadcom's Wi-Fi stack through Apple devices, mapping new attack surfaces and building toward a full over-the-air exploit chain against iPhones.