Project Zero has some excellent writeups. Here is one from last year where the author exploited a kernel vulnerability that’s directly accessible from within t

Project Zero has some excellent writeups. Here is one from last year where the author exploited a kernel vulnerability that’s directly accessible from within the sandbox: “voucher_swap: Exploiting MIG reference counting in iOS 12” https://googleprojectzero.blogspot.com/2019/01/voucherswap-exploiting-mig-reference.html https://googleprojectzero.blogspot.com/2019/01/voucherswap-e... And here is a massive writeup, also from last year, analyzing the privilege escalation parts of no fewer than five different exploit chains, which were found bundled together in a real attack, each targeting a different range of iOS versions. Not five exploits, five chains. It’s a great read: “A very deep dive into iOS Exploit chains found in the wild” https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...