speedyfriend433 / sandbox_extension-TOCTOU-bug
git clone https://github.com/speedyfriend433/sandbox_extension-TOCTOU-bug.git
Proof-of-concept showing a symlink TOCTOU issue in Apple's sandbox_extension API that lets an app read files outside its sandbox.
Why you might care
Useful for security researchers and Apple platform developers who want a concrete reproduction of a sandbox_extension path-resolution flaw. It is a bug demo, not a tool, and the README states Apple has not patched it.
+0
stars, 24h · #67,146
+0
stars, 7 days · #68,308
+38
stars, 30 days · #20,502
38
★ total
13
forks · 1 open issues
Star history (as recorded here)
LanguageObjective-C
LicenseMIT
Created2026-10-28 (10d ago)
Last push10d ago
Watchers0
OwnerUser
Links
- GitHub: github.com/speedyfriend433/sandbox_extension-TOCTOU-bug
- Releases · Issues · Hacker News mentions
README
Loading README…
Blurb generated by claude-haiku-5-5 9d ago. Star deltas marked ~ are extrapolated from partial history.