←back to thread

328 points jerlam | 2 comments | | HN request time: 0s | source
1. transpute ◴[] No.45270723[source]
"iOS 18.6.1 0-click RCE POC", 50 comments, https://news.ycombinator.com/item?id=45019671
replies(1): >>45270772 #
2. bri3d ◴[] No.45270772[source]
And since nobody got to it in the other thread, https://www.whatsapp.com/security/advisories/2025/ .

It seems to me that this exploit was used in a chain with a WhatsApp issue that would trigger the malicious DNG data to be loaded as a zero click, presumably just into WhatsApp. It’s unclear to me if there was a sandbox escape or kernel vulnerability used along with this; it might have been used to exfiltrate WhatsApp messages only.

This would explain why there’s only a single patch for a simple memory corruption issue; usually an attacker would need a lot of chained vulnerabilities to bypass mitigations on iOS, but if the vulnerability is in the exact target application to begin with, it sure does make things easier.