iOS does sandbox their processes really well, that's why this hack was as difficult as it was. The Safari thing you're talking about is JIT - iOS disables all runtime code generation across the system except in Safari (for JavaScript), but this is a completely separate thing from sandboxing.
replyActually, no, I now remember this was about iMessage specifically and how it isn't completely isolated/runs as system service or sth? Or about the renderer?
replyWhich would make sense because these attacks seem to exploit the same weakness.
iMessage's attachment renderer is also sandboxed, actually. You might be talking about this vulnerability: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero..., but the second half of the vulnerability exploit chain was finding a way out of the CoreGraphics (Apple's image rendering library) sandbox to hack the rest of the system.
replyYes, I think that was it, thanks!
reply