iOS User Space Sandbox Escape - Vulnerability Researcher
RemoteWorldwide
- Role
- Security
- Experience
- Senior
- Employment
- Full-time
Salary not disclosed
Check eligibility
Open to Worldwide. Set where you work from to check your eligibility.
No BS summary
Deeply experienced iOS userspace vulnerability researcher with proven sandbox escapes, privileged-daemon vulnerabilities, or equivalent exploit components. Needs strong iOS exploitation, reverse engineering, Mach/XPC/NSXPC, entitlements, sandboxing, arm64/arm64e, and exploit-chain reliability experience.
Core skills
iOSMachXPC
Required skills
NSXPCObjective-CSwiftCC++ARM64arm64e
We are looking for a deeply experienced iOS userspace researcher who has already delivered sandbox escapes, privileged-daemon vulnerabilities or equivalent exploit components.
The work is focused on real trust boundaries exposed through Mach, XPC, private frameworks, privileged services and entitlement-gated functionality. This is not an application-security or jailbreak-usage role.
What you’ll work on
- Privileged iOS daemons, frameworks and services reachable from sandboxed application or browser contexts.
- Mach, XPC, NSXPC, serialisation and object-bridging boundaries.
- Memory corruption, logic vulnerabilities, confused-deputy conditions, race conditions and entitlement bypasses.
- Sandbox profiles, service registration, entitlement checks and cross-process trust relationships.
- Private-framework and daemon-protocol reverse engineering across iOS releases and arm64e devices.
- Exploit-chain integration with browser and kernel researchers when required.
What you’ll deliver
- Original iOS userspace vulnerabilities that cross sandbox, entitlement, process or service boundaries.
- Reliable sandbox-escape exploit components suitable for integration into broader chains.
- Prioritised attack-surface maps for privileged services, framework brokers and entitlement-gated functionality.
- Triggers, PoCs, exploitation strategy, affected-version notes, assumptions and clear technical handover.
- Reusable tooling for service discovery, message generation, daemon instrumentation, entitlement analysis and variant research.
What we’re looking for
- Proven delivery of iOS sandbox escapes, privileged-daemon vulnerabilities or comparable userspace exploit components.
- Deep knowledge of iOS process isolation, code signing, entitlements, sandbox profiles and launch/service models.
- Strong reverse engineering across Objective-C, Swift and C/C++, including private frameworks and stripped binaries.
- Practical expertise with Mach messaging, XPC/NSXPC, serialisation formats and asynchronous service interactions.
- Advanced ARM64/arm64e userspace exploitation, including modern heap behaviour, PAC-aware strategies and constrained code execution.
- The ability to reason about chainability, target variation and reliability rather than stopping at a one-time daemon crash.
- A consistent history of independently finishing complex research.
Strong signals
- Public iOS security credits, jailbreak-chain research or comparable exploit-chain delivery.
- Experience chaining browser compromise into an iOS userspace sandbox escape.
- Custom XPC/Mach fuzzing, service-introspection or firmware-analysis tooling.
- Research across multiple major iOS generations and arm64e hardware families.
- Strong patch-diffing and variant-hunting results.
How we work
- Fully remote, with high autonomy and direct collaboration with browser and kernel specialists.
- We value technically meaningful delivery, clean handover and reproducibility over activity metrics or polished theatre.
- Public CVEs are useful but not required.
What you'll do
- Privileged iOS daemons, frameworks and services reachable from sandboxed application or browser contexts.
- Mach, XPC, NSXPC, serialisation and object-bridging boundaries.
- Memory corruption, logic vulnerabilities, confused-deputy conditions, race conditions and entitlement bypasses.
- Sandbox profiles, service registration, entitlement checks and cross-process trust relationships.
- Private-framework and daemon-protocol reverse engineering across iOS releases and arm64e devices.
- Exploit-chain integration with browser and kernel researchers when required.
- Original iOS userspace vulnerabilities that cross sandbox, entitlement, process or service boundaries.
- Reliable sandbox-escape exploit components suitable for integration into broader chains.
- Prioritised attack-surface maps for privileged services, framework brokers and entitlement-gated functionality.
- Triggers, PoCs, exploitation strategy, affected-version notes, assumptions and clear technical handover.
- Reusable tooling for service discovery, message generation, daemon instrumentation, entitlement analysis and variant research.
What they require
- Proven delivery of iOS sandbox escapes, privileged-daemon vulnerabilities or comparable userspace exploit components.
- Deep knowledge of iOS process isolation, code signing, entitlements, sandbox profiles and launch/service models.
- Strong reverse engineering across Objective-C, Swift and C/C++, including private frameworks and stripped binaries.
- Practical expertise with Mach messaging, XPC/NSXPC, serialisation formats and asynchronous service interactions.
- Advanced ARM64/arm64e userspace exploitation, including modern heap behaviour, PAC-aware strategies and constrained code execution.
- The ability to reason about chainability, target variation and reliability rather than stopping at a one-time daemon crash.
- A consistent history of independently finishing complex research.
- Public CVEs are useful but not required.
Benefits
- Fully remote, with high autonomy and direct collaboration with browser and kernel specialists.
Cybersecurity
Salary not disclosed