Mac sandbox escape

from blog The Desolation of Blog, | ↗ original
This blog post discloses a sandbox escape on macOS. I reported the issue to Apple Product Security on December 19 2019, the day the Apple Security Bounty program finally opened. (I discovered the issue in August 2019.) Today I received an email from Apple Product Security saying "we do not see any actual security implications." I've heard this kind of response before — they don't see any security implications… until they do — but in any case I obviously won't be receiving a bounty for this issue, and I'm free to publish it, again letting the public judge for themselves whether there are security implications. To save myself time, I'm just going to copy and paste my original report: