“There are 5 reports still in the patching queue”
XPC services in the PID domain skip client checks, and sandboxed apps can reach them. That one oversight produced a string of sandbox escapes and at least nine CVEs. Some of Apple’s fixes were incomplete enough to bypass, and one report got closed as “expected behavior.” Five more are still waiting on a patch. The sandbox is only as strong as the least-checked service Apple forgot it shipped.