erroneo.us
Search all guides⌘K

Security Digest · Jul 29, 2025 · Vulnerability · Mobile

Apple DarkSword Chain: JavaScriptCore, Kernel and dyld Bugs

Four more DarkSword iOS chain bugs: a JavaScriptCore RCE, two kernel flaws and a dyld PAC bypass. Fixed by iOS 18.7.2 and 26.3; exploit code leaked in 2026.

Published By erroneo.us Security Desk · Updated 3 min read23 sources

Our verdict

Check exposure

Patched on any device updated since late 2025, but DarkSword's code leaked publicly in March 2026 and works against iOS 18.4 to 18.7, so an iPhone stuck on an early iOS 18 build is easy prey.

Who must act: Anyone with iPhones or iPads on iOS 18 below 18.7.3 or iOS 26 below 26.3, Macs on Tahoe below 26.3, Sequoia below 15.7.2 or Sonoma below 14.8.2, or apps on WebKitGTK or WPE WebKit below 2.50.0.

Who can relax: Devices on iOS 26.3 or later or 27.x, iPhones on iOS 18.7.3 or later, where Apple says the DarkSword fixes shipped in 2025, and Macs on Tahoe 26.3 or later.

Affected
iOS and iPadOS 18 before 18.6 (CVE-2025-31277) and before 18.7.2 (CVE-2025-43510, CVE-2025-43520)
iOS and iPadOS 26 before 26.1 (kernel bugs) and before 26.3 (CVE-2026-20700)
macOS Tahoe before 26.3; Sequoia before 15.7.2; Sonoma before 14.8.2
Safari before 18.6 on macOS Ventura and Sonoma (CVE-2025-31277)
tvOS, watchOS and visionOS before 26.3
WebKitGTK and WPE WebKit before 2.50.0 (CVE-2025-31277)
Fixed in
iOS and iPadOS 18.7.2 (CVE-2025-31277 since 18.6); no iOS 18 note lists CVE-2026-20700
iOS and iPadOS 26.3
macOS Tahoe 26.3, Sequoia 15.7.2, Sonoma 14.8.2
Safari 18.6
tvOS, watchOS and visionOS 26.3
WebKitGTK and WPE WebKit 2.50.0
CVSS
8.8 (v3.1, CISA-ADP)
EPSS
1.7% (percentile 76)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Pull an OS version report from MDM and flag iPhones and iPads on iOS 18 below 18.7.3 or iOS 26 below 26.3.
  2. Update flagged devices to iOS 26.7.1 or 27.0.1, or iOS 18.7.10 on the iPhone XS, XR and iPad 7th generation, and enforce a minimum OS version.
  3. Check Macs with sw_vers -productVersion and flag Tahoe below 26.3, Sequoia below 15.7.2 and Sonoma below 14.8.2.
  4. On Linux, update WebKitGTK or WPE WebKit to 2.50.4 or later, which also covers CVE-2025-43529.
  5. Turn on Lockdown Mode for high-risk users and for devices that cannot update.

How to check if you are affected or compromised

  • Collect a sysdiagnose and search unified logs for entries tagged [DarkSword-WIFI-DUMP] from mediaplaybackd, which iVerify rates high confidence.
  • Look for /private/var/tmp/keychain-2.db, /private/var/tmp/wifi_passwords.txt or /private/var/tmp/icloud_dump/ in a forensic extraction.
  • Run mvt-ios with iVerify's STIX2 indicators; Safari history is not wiped, so delivery domains such as static.cdncounter[.]net can show up.
  • If any indicator matches, get a professional mobile forensics review and treat keychain items, Wi-Fi passwords, messages and wallets as exposed.

What happened#

On March 18, 2026, Google's Threat Intelligence Group, with Lookout and iVerify, published its DarkSword report: a six-bug chain that takes over iPhones on iOS 18.4 through 18.7 from a web page. Its zero-day JavaScriptCore bug, CVE-2025-43529, has its own brief. This one covers the four other Apple bugs, all now in KEV:

  • CVE-2025-31277: the JavaScriptCore entry point for devices below iOS 18.6, which Google calls "a JIT optimization/type confusion bug." iOS 18.6, Sequoia 15.6 and Safari 18.6 fixed it on July 29 and 30, 2025, crediting outside researchers. It was not a zero-day.
  • CVE-2025-43510: an XNU copy-on-write bug used to escape from the GPU process into mediaplaybackd.
  • CVE-2025-43520: a kernel race in XNU's file system code that gives kernel memory read and write. Both kernel bugs were fixed in iOS 26.1 and macOS on November 3, 2025, and in iOS 18.7.2 on November 5. Apple listed them on December 12.
  • CVE-2026-20700: a dyld pointer-authentication bypass. iOS 26.3 and macOS Tahoe 26.3 fixed it on February 11, 2026. Apple says it "may have been exploited in an extremely sophisticated attack" and credits Google's Threat Analysis Group.

CISA added CVE-2026-20700 to KEV on February 12, 2026, and the other three (1, 2, 3) on March 20. CISA's ADP scores CVE-2025-31277 at 8.8 (NVD); CVE-2025-43510 and CVE-2026-20700 score 7.8. Google saw the chain from November 2025 with UNC6748 in Saudi Arabia, customers of Turkish vendor PARS Defense, and UNC6353 on Ukrainian sites. On March 23, TechCrunch reported a newer version leaked on GitHub. iVerify's Matthias Frielingsdorf said: "The exploits will work out of the box."

Who is affected#

iOS 18 before 18.7.2 and iOS 26 before 26.3, Macs on Tahoe before 26.3, Sequoia before 15.7.2 or Sonoma before 14.8.2, and WebKitGTK or WPE WebKit before 2.50.0 (WSA-2026-0001). No iOS 18 or Sequoia note lists CVE-2026-20700. On April 1, 2026, Apple offered iOS 18.7.7 to more devices, saying "The fixes associated with the DarkSword exploit first shipped in 2025."

Do you really need to act?#

Most fleets do not: current builds are iOS 26.7.1, 27.0.1 and 18.7.10. The risk is an iPhone that stayed on early iOS 18 with automatic updates off. In March, iVerify estimated up to 270 million exposed devices. With public code, attackers need no skill. iVerify says the exploits fail under Lockdown Mode without extra bypasses.

What to do now#

  1. Pull an MDM report. Flag iOS 18 below 18.7.3 and iOS 26 below 26.3.
  2. Update to iOS 26.7.1 or 27.0.1, or 18.7.10 on the iPhone XS and XR.
  3. On Macs, run sw_vers -productVersion.
  4. On Linux, update WebKitGTK or WPE WebKit to 2.50.4 or later.
  5. Turn on Lockdown Mode where updating is impossible.

How to tell if you were hit#

iVerify rates unified log entries tagged [DarkSword-WIFI-DUMP] from mediaplaybackd as high confidence; collect a sysdiagnose and search it. Look for /private/var/tmp/keychain-2.db, /private/var/tmp/wifi_passwords.txt and /private/var/tmp/icloud_dump/. Safari history is not wiped, so run mvt-ios check-backup --iocs darksword.stix2 --output ./out ./backup with iVerify's indicators. If anything matches, get a forensics review and treat keychain items, messages and wallets as exposed.

Timeline#

  • — iOS 18.6 fixes CVE-2025-31277.
  • — iOS 26.1 fixes both kernel bugs; iOS 18.7.2 follows Nov 5.
  • — iOS 26.3 fixes CVE-2026-20700; KEV follows Feb 12.
  • — Google, iVerify and Lookout publish DarkSword.
  • — CISA adds the other three to KEV.
  • — TechCrunch reports the GitHub leak.
  • — Apple widens iOS 18.7.7.

Vulnerability records

  • CVE-2025-31277 · KEV 2026-03-20 · The issue was addressed with improved memory handling.
  • CVE-2025-43510 · KEV 2026-03-20 · A memory corruption issue was addressed with improved lock state checking.
  • CVE-2025-43520 · KEV 2026-03-20 · A memory corruption issue was addressed with improved memory handling.
  • CVE-2026-20700 · KEV 2026-02-12 · A memory corruption issue was addressed with improved state management.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Apple — About the security content of iOS 18.6 and iPadOS 18.6 support.apple.com
  2. Apple — About the security content of iOS 26.1 and iPadOS 26.1 support.apple.com
  3. Apple — About the security content of iOS 18.7.2 and iPadOS 18.7.2 support.apple.com
  4. Apple — About the security content of iOS 26.3 and iPadOS 26.3 support.apple.com
  5. Apple — About the security content of macOS Tahoe 26.3 support.apple.com
  6. Apple — About the security content of iOS 18.7.7 and iPadOS 18.7.7 support.apple.com
  7. Apple — Apple security releases support.apple.com
  8. CVE record — CVE-2025-31277 cve.org
  9. CVE record — CVE-2025-43510 cve.org
  10. CVE record — CVE-2025-43520 cve.org
  11. CVE record — CVE-2026-20700 cve.org
  12. NVD — CVE-2025-31277 nvd.nist.gov
  13. NVD — CVE-2025-43510 nvd.nist.gov
  14. NVD — CVE-2026-20700 nvd.nist.gov
  15. CISA — Known Exploited Vulnerabilities: CVE-2026-20700 cisa.gov
  16. CISA — Known Exploited Vulnerabilities: CVE-2025-31277 cisa.gov
  17. CISA — Known Exploited Vulnerabilities: CVE-2025-43510 cisa.gov
  18. CISA — Known Exploited Vulnerabilities: CVE-2025-43520 cisa.gov
  19. CVE record — CVE-2025-43529 cve.org
  20. WebKitGTK — Security Advisory WSA-2026-0001 webkitgtk.org
  21. Google Threat Intelligence Group — The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors cloud.google.com
  22. iVerify — DarkSword iOS exploit kit explained iverify.com

Coverage and analysis

  1. TechCrunch — Someone has publicly leaked an exploit kit that can hack millions of iPhones techcrunch.com