pwn4fun Spring 2014 - Safari - Part II
Summary: Ian Beer's Project Zero write-up describes chaining a Safari JavaScript integer truncation bug into the renderer process with two OS X kernel bugs to launch Calculator.app as root from inside the Safari sandbox. The kernel exploit abused an OS X GPU driver that trusted a user-supplied kernel C++ object pointer and called a virtual function, using kernel pointers in the IOKit registry to defeat kASLR and a kernel ROP payload to run the app as root.
Key Takeaway: The WebProcess sandbox profile grants near-unrestricted access to GPU drivers via iokit-open for IOAccelerator and related user clients, so a single renderer compromise reaches kernel attack surface that TrustedBSD hooks and the sandbox policy were never positioned to mediate.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026