Apple continue to tighten their sandbox profiles, restricting available attack surface and forcing attackers to build longer bug chains to successfully compromise devices. In this talk I'll cover a recent 2023 ITW iOS 16 full chain, documenting the first case of an ITW chain exploiting Safari’s custom IPC mechanism to escape the newly-hardened renderer sandbox