Hacker News Reader

I imagine they use one exploit to get code execution in iMessage, then another exploit to escape sandbox and execute code in kernel.

Yeah. Here’s a 2016 write up when Pegasus (presumably a different deployment) was leaked and reversed: https://citizenlab.ca/2016/08/million-dollar-dissident-iphon...