How does software like pegasus work?

As far as I know (which is not much) every process in Android is isolated and runs as it's own user. Which limits the access. All apps run on ART(JVM), which is a complete virtual machine in itself. If a text sms exploits SMS app it should not be able to do more damage then given permission.

Last of all, why didn't google patched the vulnerability, they collect hell lot of analytics. Somewhere it must have revealed itself?

pegasus privacy software work