macOS Recovery Mode Safari allowed unrestricted writes to system partitions (and root persistence)
I accidentally discovered 2 vulnerabilities in macOS Recovery Mode's Safari: one allowing arbitrary writes to system partitions and root persistence (CVSS 8.5), the other allowing unrestricted file reads (CVSS 4.6).