A survey of recent iOS kernel exploits
Summary: Google Project Zero's Brandon Azad published a reference cataloging public iOS kernel exploits from local app context across iOS 10 through iOS 13, tracing each from the vulnerability's initial primitive to kernel read/write. The post covers exploits including mach_portal, extra_recipe, Yalu102, and ziVA, and maps the techniques used against iOS kernel mitigations in hardware and software.
What's compelling: The document lays out, exploit by exploit, how a single vulnerability primitive - a dangling Mach port, a 240-byte out-of-bounds read/write, a hijacked virtual method call - was chained into full kernel read/write, which is the concrete playbook an attacker needs once any one bug is found.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026