In-the-wild iOS Exploit Chain 3
Summary: Google Project Zero documented an in-the-wild iOS exploit chain targeting iOS 11 through 11.4.1 across nearly 10 months, covering devices from the iPhone 5s through the iPhone X, and it was the first chain Project Zero observed with a separate sandbox escape exploit. The sandbox escape was a libxpc regression in which a bounds check became a != comparison against a single boundary value, letting a wireid read from an IPC message index the xpc_types array and call a function pointer at offset +0x90 without bounds checking.
Key Takeaway: The bug was reachable by flipping a few bits in an XPC message on any iOS 11.0-11.4.1 device, and Project Zero notes that a unit test, code review, or fuzzing should have caught it in a core IPC library that Apple had marketed as a security boundary.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026