Trellix researchers discovered a new class of privilege escalation bugs based on the ForcedEntry attack, which exploited a feature of macOS and iOS to deploy the NSO Group’s mobile Pegasus malware. The new class of bugs allows arbitrary code to be executed in the context of several platform applications, resulting in privilege escalation and sandbox escape on both macOS and iOS.  The vulnerabilities range in severity from medium to high, with CVSS scores ranging from 5.1 to 7.1.

Read full article on GBHackers