‹ back

The iOS 27 Beta 5 Red Wedding

Aug 2026 / iOS 27 beta 5 / 24A5408d

Apple cut off a cluster of MobileContainerManager sandbox escapes in one beta. I am releasing the Objective-C PoCs and short writeups instead of letting them disappear with the patch.

MobileHouseArrest PoC ↗ geod / MCM PoC ↗ InstallCoordination PoC ↗ cfprefsd PoC ↗
A Red Wedding banquet scene with Tim Cook raising a goblet

What happened

iOS 27 beta 5 was a Red Wedding for the sandbox escape and MobileGestalt routes I had been testing. The main MobileContainerManager entry points were all blocked in build 24A5408d. My guess is that Mythos helped Apple find the cluster.

The fixes landed before I published the work, so here are the clean PoCs, the request shapes, and the exact paths each bug reached.

The bugs

MobileHouseArrest identity trust

patched

MobileContainerManager trusted the caller’s CodeDirectory identifier as an authorization key. A development-signed app using com.apple.mobile.MobileHouseArrest could request foreign class-2 app containers and class-7 app groups.

/private/var/mobile/Containers/Data/Application/<UUID>/ /private/var/mobile/Containers/Shared/AppGroup/<UUID>/

This included the Notes app group and its NoteStore.sqlite database, making it direct access to sensitive user note data. The repository also covers the separate class-13 route to the fixed MobileGestalt cache directory.

View MobileHouseArrest PoC on GitHub

geod class-12 traversal

patched

Class 12 treated com.apple.geod as a built-in allowed container. An unchecked partDomain then redirected its read/write sandbox extension into the MobileGestalt system group.

/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/ /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist

The result was read/write access to the fixed MobileGestalt cache directory and its live plist, not arbitrary filesystem access.

View geod / MCM PoC on GitHub

InstallCoordination persisted state

entry patched

A class-13 authorization gap and partDomain traversal exposed the state used by installcoordinationd. An app could place a promise graph into those directories. The daemon restored the graph and followed the final localization symlink while materializing InfoPlist.strings.

.../Library/InstallCoordination/PromiseStaging/ .../Library/InstallCoordination/DataPromises/ .../Library/InstallCoordination/Coordinators/

Beta 5 blocks the known normal-app entry. The persisted-graph trust and final-symlink behavior remain in the daemon, but this route can no longer reach their state files.

View InstallCoordination PoC on GitHub

cfprefsd missing-file creation

still present

A raw-container path race and a final-symlink mismatch make the system preferences daemon create one selected missing file. The retained file is empty. The primitive cannot replace or truncate an existing file, and it does not control the new file’s contents.

selected missing pathname → new 0644, zero-byte file

The relevant logic is still present in the iOS 27 beta 5 CoreFoundation image. Runtime confirmation on that exact build is still pending.

View cfprefsd PoC on GitHub

Version status

The MobileHouseArrest, class-13, geod, and known InstallCoordination entry routes are patched in iOS 27 beta 5. The cfprefsd logic still appears present. I have not verified iOS 26.6.1.

Each repository contains a short writeup and minimal Objective-C source for the relevant request or chain.