https://research.stackhopper.co/tags/ios/Recent content in Ios on Stackhopper ResearchHugoen-USStackhopper Security LLC.Wed, 25 Mar 2026 00:00:00 +0000https://research.stackhopper.co/posts/sandbox-escape-via-gamekit-and-cfprefsd/Wed, 25 Mar 2026 00:00:00 +0000https://research.stackhopper.co/posts/sandbox-escape-via-gamekit-and-cfprefsd/<h2 id="summary">Summary</h2> <p>A sandboxed iOS application with only the <code>com.apple.developer.game-center</code> entitlement can escape the app sandbox to write files with controlled content and filenames to any location writable by the <code>mobile</code> user. Tested on iOS 26.4.</p> <h2 id="explanation">Explanation</h2> <p>The <code>cacheImageData:inSubdirectory:withFileName:handler:</code> method on <code>gamed</code>&rsquo;s <code>GKDaemonProxy</code> (via the <code>GKUtilityService</code> XPC endpoint) writes data to <code>/var/mobile/Library/Caches/GameKit/Images/&lt;subdirectory&gt;/&lt;fileName&gt;</code>. Neither the <code>subdirectory</code> or the <code>fileName</code> parameters are validated for path traversal payloads.</p> <p>By sending a raw XPC message directly to <code>gamed</code> via <code>GKDaemonProxy</code>, a third-party sandboxed iOS app causes <code>gamed</code> (which runs as <code>mobile</code> outside the app sandbox) to write attacker-controlled data with a desired filename to a path outside the sandbox&rsquo;s reach. No GameKit authentication is required.</p>