A NEW ERA OF MACOS SANDBOX ESCAPES: DIVING INTO AN OVERLOOKED ATTACK SURFACE AND UNCOVERING 10+ NEW VULNERABILITIES

Summary from the TLDR InfoSec newsletter

Researchers have discovered multiple vulnerabilities in macOS sandbox escapes that allow attackers to bypass app sandbox restrictions and execute arbitrary system commands. Exploiting overlooked XPC services in system frameworks can lead to full sandbox escapes where dropped files are not quarantined, enabling attackers to escape sandbox restrictions. Apple addressed some of these vulnerabilities in macOS Ventura 13.3 by implementing checks on incoming XPC clients to prevent unauthorized sandbox escapes.