In this presentation I will tell my story how I found a zero-click vulnerability in macOS Calendar, which allows an attacker to add or delete arbitrary files inside the Calendar sandbox environment.This will directly lead to arbitrary code execution. I will demonstrate how this can be combined with Gatekeeper evasion and TCC evasion with Photos to compromise user sensitive Photos iCloud data.

First part of the vulnerability chain was covered on my presentation at Disobey 2023. Now with macOS Sonoma, all the chained vulnerabilities are fixed and I can finally share all the details.