In-the-wild iOS Exploit Chain 4
Summary: Project Zero's Ian Beer documented an in-the-wild iOS exploit chain, disclosed 2019-Aug-29, that supported iOS 12 through 12.1 and combined a cfprefsd sandbox escape with a kernel bug in an IOKit driver whose external method performs an unbounded memmove with an attacker-controlled length. The two vulnerabilities were unpatched when the chain was found in the wild, were reported to Apple on a 7-day deadline, and were patched in iOS 12.1.4, covering devices from the iPhone 5s through the iPhone X.
Why it matters: The kernel bug was, in Beer's words, easy to find and exploit, and the chain was used to install an implant and enable real-time surveillance of users - so the barrier between a targeted attack and a working one was low.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026