Privilege Escalation

Code that runs inside an app has the rights of that app: its files, its memory, and the permissions the user granted. Escalation uses another flaw to act as a process with more rights. On Android the top of that ladder is root. On iOS it is a high-privilege context outside the app sandbox. An attack that starts in a browser uses this second step so the payload can run inside a system process.

A cheat or an injected library in a Unity player starts with the rights of the game process. Reading and writing the game's own memory uses those rights. Changing files the game does not own, or hiding inside a system process, takes escalation.

An exploit runs inside a WebView's browser process and can only touch that sandbox. A second bug lets the same code run as root, and from there it writes itself into a system process. The first bug got execution. The second bug got the rights.

• Sandbox
• Code Injection
• Zero-Day
• Zero-Click Exploit

Privilege elevation