iPhone CVE Tracker 2025-2026
Active Zero-Days, DarkSword & Coruna Exploit Chains
A live tracker of real iPhone and iOS CVEs from 2025 and 2026 — covering the DarkSword full-chain exploit kit, the Coruna exploit kit targeting older iPhones, and actively exploited zero-days in WebKit and ImageIO. All data sourced from CISA KEV, Apple Security Updates, NVD, and Google Threat Intelligence Group.
iPhone Settings > General > Software Update — the single most important security action. Update to iOS 26.3 or later to patch all DarkSword chain vulnerabilities.
The DarkSword exploit chain — 6 vulnerabilities from a single web visit to full kernel compromise on iPhone, bypassing Apple's PAC and TPRO hardware security.
The DarkSword Exploit Campaign
On March 18, 2026, Google Threat Intelligence Group (GTIG), iVerify, and Lookout jointly disclosed DarkSword — a full-chain exploit kit that chains six vulnerabilities (three of them zero-days) to achieve complete device compromise. The entire attack is implemented in JavaScript, executing within Safari's browser engine without requiring any app installation. It bypasses Apple's Pointer Authentication Codes (PAC) and Trusted Page Reference Owner (TPRO) — two of Apple's primary kernel integrity controls.
Attribution & Scope
Attributed to Russian-linked threat actors targeting Ukrainian users via watering hole attacks on compromised legitimate websites. iVerify estimated up to 270 million iPhones remained on vulnerable iOS versions at the time of disclosure. The entire exploit chain runs in JavaScript within Safari — no app installation required.
Primary target: iPhone was the primary target of DarkSword. All 6 CVEs in the chain affect iOS. The attack is delivered via Safari watering hole attacks — the victim only needs to visit a compromised website.
The 6-CVE Exploit Chain
- 1. CVE-2025-31277 — JavaScriptCore memory corruption (initial access, not zero-day)
- 2. CVE-2025-43529 — JavaScriptCore UAF (alternative initial access, zero-day)
- 3. CVE-2026-20700 — dyld PAC/TPRO bypass (Stage 2, zero-day)
- 4. CVE-2025-14174 — ANGLE Metal OOB write (sandbox escape, zero-day)
- 5. CVE-2025-43510 — iOS kernel memory management (privilege escalation)
- 6. CVE-2025-43520 — iOS kernel memory corruption (kernel compromise)
Attack flow: Visit compromised website → WebContent RCE → PAC bypass → Sandbox escape → Kernel R/W → Data exfiltration → Self-deleting fileless cleanup.
Why This Matters for iPhone Users
DarkSword is the most sophisticated iOS exploit chain publicly disclosed since Pegasus. It proves that Apple's hardware-enforced security controls — PAC and TPRO — are bypassable with a JavaScript-only attack delivered through Safari. Any iPhone running iOS below 18.7.5 or below 26.3 is vulnerable to the full chain.
Key takeaways:
- Update to iOS 26.3 or later immediately — all 6 chain vulnerabilities are patched
- Enable Lockdown Mode if you are at elevated risk (journalists, activists, executives)
- DarkSword is fileless — traditional security apps cannot detect it
- Safari is the attack vector — consider alternative browsers for high-risk browsing
- 270 million iPhones were on vulnerable iOS versions at disclosure time — check your version now
Disclaimer: This tracker is compiled from public sources including CISA KEV, Apple Security Updates, NVD, Google Threat Intelligence Group, iVerify, Lookout, and security vendor blogs. Patch status changes rapidly — always verify against the Apple Security Updates page and CISA KEV catalog for the latest status. Last updated: September 1, 2026.
Actively Exploited Zero-Days (Now Patched)
These iPhone vulnerabilities were exploited as zero-days in the wild before patches were available. All five are listed in CISA's Known Exploited Vulnerabilities catalog. If you haven't applied the relevant Apple security updates, you are still vulnerable. Check your iPhone version against the patch dates below.
Apple ImageIO Out-of-Bounds Write Vulnerability (DNG/JPEG-Lossless)
A pre-authentication flaw in screensharingd's Secure Remote Password (SRP) handshake. An attacker on the network can authenticate to Screen Sharing without valid credentials and gain root-level file access. NCSC-NL confirmed active exploitation: on every internet-exposed Mac with port 5900 reachable, attackers gained root access and installed a Monero cryptocurrency miner (XMRig 6.26.0 disguised as com.apple.airportd). CISA rescored from 7.1 to 9.8 on August 14. Microsoft Security Intelligence also observed exploitation.
Update to iOS 18.6.2 or later. Disable auto-loading images in Messages if high-risk.
Apple dyld Pointer Authentication Code (PAC) Bypass
A memory corruption vulnerability in dyld, Apple's dynamic linker — the first code that executes when any app launches. Allows bypass of both Pointer Authentication Codes (PAC) and Trusted Page Reference Owner (TPRO), Apple's two primary hardware-enforced kernel integrity controls. Served as Stage 2 of the DarkSword exploit chain. The vulnerability reportedly existed in dyld's code path for nearly two decades. Discovered by Google GTIG.
Update to iOS 26.3 or later. Enable Lockdown Mode for high-risk users.
Apple WebKit Use-After-Free Vulnerability (JavaScriptCore DFG JIT)
A use-after-free in JavaScriptCore's DFG JIT compiler — a missing write barrier leads to GC freeing live objects. Processing maliciously crafted web content leads to arbitrary code execution. Apple confirmed exploitation in "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 26. Discovered by Google Threat Analysis Group (GTIG). Part of the DarkSword exploit chain.
Update to iOS 18.7.3 or later, or iOS 26.2 or later.
ANGLE Metal Staging Buffer Out-of-Bounds Write
An out-of-bounds write in ANGLE's Metal backend when uploading depth textures via a staging buffer. The staging buffer size uses GL_UNPACK_IMAGE_HEIGHT instead of actual texture height, causing GPU memory corruption. Served as the WebContent sandbox escape in the DarkSword exploit chain. On iOS, WebKit uses ANGLE as its WebGL backend, making Safari directly vulnerable. Discovered by Apple SEAR + Google GTIG.
Update Chrome to 143.0.7499.110+. Update Electron-based apps.
Apple ImageIO Out-of-Bounds Write Vulnerability (DNG/JPEG-Lossless)
An out-of-bounds write in Apple's Image I/O / RawCamera image processing code. A crafted DNG/JPEG-lossless image triggers a buffer overwrite when TIFF metadata (SamplesPerPixel) disagrees with JPEG SOF3 component count. Exploitable via iMessage, Mail, Safari — any app that processes images. Apple confirmed exploitation in "extremely sophisticated attack against specific targeted individuals." Similar ImageIO bugs have been used in Pegasus spyware campaigns.
Update to iOS 18.6.2 or later. Disable auto-loading images in Messages if high-risk.
The Coruna iOS Exploit Kit
On March 3, 2026, Google Threat Intelligence Group (GTIG) and iVerify disclosed Coruna — a powerful iOS exploit kit containing 23 exploits across 5 full exploit chains, targeting iPhone models running iOS 13.0 through 17.2.1. The kit was used by multiple threat actors throughout 2025, from state-sponsored espionage to financially motivated crypto theft.
Attribution & Proliferation
Coruna demonstrates how exploit kits proliferate from state actors to financially motivated criminals:
- Early 2025: First observed in use by a customer of a commercial surveillance vendor
- Mid 2025: Used by UNC6353 (suspected Russian espionage group) in watering hole attacks on Ukrainian websites
- Late 2025: Mass-deployed by UNC6691 (financially motivated Chinese threat actor) on fake cryptocurrency and gambling sites — delivering PlasmaLoader/PlasmaGrid malware targeting crypto wallets (MetaMask, Phantom, Exodus, BitKeep, Uniswap)
Key Coruna CVEs
All were previously patched by Apple, but exploited on unpatched devices:
- CVE-2024-23222 — WebKit type confusion (RCE, patched iOS 17.3, Jan 2024)
- CVE-2023-43000 — WebKit use-after-free (RCE)
- CVE-2023-41974 — Kernel use-after-free (privilege escalation, CISA KEV added March 7, 2026)
- CVE-2023-32434 — Kernel memory corruption (also used in Operation Triangulation)
- CVE-2023-38606 — Kernel memory management (also used in Operation Triangulation)
Why This Matters for iPhone Users
Coruna shows how exploit kits move from state-sponsored surveillance to financially motivated crime. The same kernel exploits from Operation Triangulation (2023) were reused in Coruna (2025). Older iPhones (iPhone 8, X, 7, 6s, SE 1st gen) are most at risk because they cannot update to iOS 18+.
Key takeaways:
- Older iPhones (iPhone 8, X, 7, 6s, SE 1st gen) are most at risk — they can't update to iOS 18+
- Apple backported patches to iOS 15.8.7 and 16.7.15 in March 2026 — update if you have an older device
- Coruna shows how exploit kits proliferate from state actors to financially motivated criminals
- The same kernel exploits from Operation Triangulation (2023) were reused in Coruna (2025)
- Crypto wallet users on older iPhones were specifically targeted by UNC6691
Other DarkSword Chain Vulnerabilities (Patched)
These vulnerabilities were components of the DarkSword exploit chain that were not zero-days at the time of exploitation (they had been patched), but millions of devices hadn't updated. They are included here because they complete the picture of how the chain worked.
JavaScriptCore Memory Corruption (DarkSword Stage 1a)
A memory corruption vulnerability in JavaScriptCore, the JavaScript engine in WebKit. Used as the initial access vector (Stage 1a) in the DarkSword exploit chain for devices running iOS 18.4. Not a zero-day at time of exploitation — was patched in iOS 18.6 — but many devices hadn't updated.
Update to latest iOS. This was patched before DarkSword was deployed, but unpatched devices were the primary target.
iOS Kernel Memory Management Vulnerability (DarkSword Stage 4)
A memory management vulnerability in the iOS kernel used for privilege escalation (Stage 4) in the DarkSword exploit chain. After the sandbox escape, this vulnerability elevated the attacker from mediacodec-level access to kernel-level read/write.
Update to latest iOS.
iOS Kernel Memory Corruption (DarkSword Stage 5 — Kernel Compromise)
A memory corruption vulnerability in the iOS kernel used for final kernel compromise (Stage 5) in the DarkSword exploit chain. This was the last step before full device takeover — after this, the attacker had complete control and could exfiltrate data filelessly.
Update to latest iOS.
Is Your iPhone Really Secure?
With 5 actively exploited zero-days and a full-chain exploit kit targeting iPhone users, Apple security in 2026 requires active defense — not just "Macs don't get viruses." I can audit your Mac systems, apply security hardening, verify Screen Sharing is not exposed, and help you enable Lockdown Mode if you're at elevated risk.