Details of the specific exploit: > After several validation checks to ensure the device being exploited was a real device, the final payload would be served to

Details of the specific exploit: > After several validation checks to ensure the device being exploited was a real device, the final payload would be served to exploit CVE- 2021-1879. This exploit would turn off Same-Origin-Policy protections in order to collect authentication cookies from several popular websites, including Google, Microsoft, LinkedIn, Facebook, and Yahoo and send them via WebSocket to an attacker-controlled IP. The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated. There was no sandbox escape or implant delivered via this exploit. The exploit targeted iOS versions 12.4 through 13.7. This type of attack, described by Amy Burnett in Forget the Sandbox Escape: Abusing Browsers from Code Execution, is mitigated in browsers with Site Isolation enabled, such as Chrome or Firefox. For this to be effective you would need to be logged in to your accounts on Safari, rather than just logged in through the respective app (FB for example). So this would have limited effectiveness. Also if you browse with Safari in Private mode it probably wouldn't have worked at all.