iOS User Space Sandbox Escape - Vulnerability Researcher

- Privileged iOS daemons, frameworks and services reachable from sandboxed application or browser contexts.

- Mach, XPC, NSXPC, serialisation and object-bridging boundaries.

- Memory corruption, logic vulnerabilities, confused-deputy conditions, race conditions and entitlement bypasses.

- Sandbox profiles, service registration, entitlement checks and cross-process trust relationships.

- Private-framework and daemon-protocol reverse engineering across iOS releases and arm64e devices.

- Exploit-chain integration with browser and kernel researchers when required.

- Original iOS userspace vulnerabilities that cross sandbox, entitlement, process or service boundaries.

- Reliable sandbox-escape exploit components suitable for integration into broader chains.

- Prioritised attack-surface maps for privileged services, framework brokers and entitlement-gated functionality.

- Triggers, PoCs, exploitation strategy, affected-version notes, assumptions and clear technical handover.

- Reusable tooling for service discovery, message generation, daemon instrumentation, entitlement analysis and variant research.

- Proven delivery of iOS sandbox escapes, privileged-daemon vulnerabilities or comparable userspace exploit components.

- Deep knowledge of iOS process isolation, code signing, entitlements, sandbox profiles and launch/service models.

- Strong reverse engineering across Objective-C, Swift and C/C++, including private frameworks and stripped binaries.