https://varik.dev/blog Varik's blog en-us varikmatevosyan@gmail.com (Varik Matevosyan) varikmatevosyan@gmail.com (Varik Matevosyan) Mon, 27 Jul 2026 00:00:00 GMT https://varik.dev/blog/jsc/pois0nsword-native-calls https://varik.dev/blog/jsc/pois0nsword-native-calls Arbitrary read/write is not code execution. This post walks the road from read64/write64 to a real native call inside the WebContent sandbox on iOS 26.1: disabling the GC, parking a thread inside dlopen, making dyld's own allocator install our interpose table, the three locks in that path which 26.1 now checks in ways 18.6 did not - and the default-false embedder preference that silently disables the phone-number trigger on stock hardware. Mon, 27 Jul 2026 00:00:00 GMT varikmatevosyan@gmail.com (Varik Matevosyan) PWNJSCJavaScriptCoreWebKitSafariiOSdyldPACBrowser Exploitation