Amazing writeup of how a series of exploits were chained together to root a mac, starting from a Safari JS JIT bug. https://github.com/saelo/pwn2own2018/blob/master/README.md