FORCEDENTRY: Sandbox Escape
Summary: Google Project Zero detailed the sandbox escape stage of FORCEDENTRY, the zero-click iMessage exploit Citizen Lab attributed to NSO, which used a .gif attachment that was really a PDF to trigger a heap buffer overflow in the ImageIO JBIG2 decoder. The escape relied only on logic bugs, deserializing an NSFunctionExpression hidden in a leaked JBIG2Bitmap object to delete the delivering .gif file and get a payload NSPredicate evaluated in the CommCenter process via the com.apple.commcenter.xpc NSXPC service.
Why it matters: The escape used no memory corruption at all, so Pointer Authentication and Memory Tagging, the mitigations Apple is rolling out, have no impact on it - and the same NSXPC protocol weakness that let NSO reach CommCenter from the IMTranscoderAgent sandbox is a design pattern, not a one-off bug.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026