Escaping the Safari Sandbox in iOS 16

Ian Beer of Google Project Zero examines one part of a 2023 in-the-wild iOS 16 exploit chain. Apple has been tightening the Safari renderer sandbox, which removes direct access to kernel-adjacent GPU drivers and forces attackers to build longer chains. Moving GPU work into a separate GPU process made WebKit's custom IPC layer the bridge between web content and the services behind it. That IPC framework was never disabled, even though the feature it served was not exposed to users.

The talk then shows the flaw at the centre of this stage: an IPC message handler accepts a vector from the untrusted side and copies it into a buffer with no size check. The rest of the talk covers the exploitation framework built on that primitive. The payload is a very large serialized NSExpression object that was meant to have dangerous operations disabled by flags, which the attacker simply overwrote. Beer describes how he recovered readable logic from it by converting the expression graph, spotting NSNull alloc calls used to sequence statements, and refactoring the output.

The final stages run JavaScript inside the GPU process to corrupt objects, build a call interface to signed function pointers, and take over an existing IPC connection to issue the messages needed for a kernel bug. Beer concludes that a simple bad copy enabled the whole chain and that data-only exploitation is now routine. He said a companion blog post with the full details would follow.