---
title: "Apple DarkSword Chain: JavaScriptCore, Kernel and dyld Bugs"
url: https://erroneo.us/security/briefs/apple-ios-darksword-cve-2025-31277-43510-43520-2026-20700/
description: "Four more DarkSword iOS chain bugs: a JavaScriptCore RCE, two kernel flaws and a dyld PAC bypass. Fixed by iOS 18.7.2 and 26.3; exploit code leaked in 2026."
type: security-brief
section: "Security Digest"
date_published: 2025-07-29
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-31277", "CVE-2025-43510", "CVE-2025-43520", "CVE-2026-20700"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apple DarkSword Chain: JavaScriptCore, Kernel and dyld Bugs

**Verdict: Check exposure.** Patched on any device updated since late 2025, but DarkSword's code leaked publicly in March 2026 and works against iOS 18.4 to 18.7, so an iPhone stuck on an early iOS 18 build is easy prey.

- **Who must act:** Anyone with iPhones or iPads on iOS 18 below 18.7.3 or iOS 26 below 26.3, Macs on Tahoe below 26.3, Sequoia below 15.7.2 or Sonoma below 14.8.2, or apps on WebKitGTK or WPE WebKit below 2.50.0.
- **Who can relax:** Devices on iOS 26.3 or later or 27.x, iPhones on iOS 18.7.3 or later, where Apple says the DarkSword fixes shipped in 2025, and Macs on Tahoe 26.3 or later.
- **Affected:** iOS and iPadOS 18 before 18.6 (CVE-2025-31277) and before 18.7.2 (CVE-2025-43510, CVE-2025-43520); iOS and iPadOS 26 before 26.1 (kernel bugs) and before 26.3 (CVE-2026-20700); macOS Tahoe before 26.3; Sequoia before 15.7.2; Sonoma before 14.8.2; Safari before 18.6 on macOS Ventura and Sonoma (CVE-2025-31277); tvOS, watchOS and visionOS before 26.3; WebKitGTK and WPE WebKit before 2.50.0 (CVE-2025-31277)
- **Fixed:** iOS and iPadOS 18.7.2 (CVE-2025-31277 since 18.6); no iOS 18 note lists CVE-2026-20700; iOS and iPadOS 26.3; macOS Tahoe 26.3, Sequoia 15.7.2, Sonoma 14.8.2; Safari 18.6; tvOS, watchOS and visionOS 26.3; WebKitGTK and WPE WebKit 2.50.0
- **CVEs:** CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2026-20700
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull an OS version report from MDM and flag iPhones and iPads on iOS 18 below 18.7.3 or iOS 26 below 26.3.
2. Update flagged devices to iOS 26.7.1 or 27.0.1, or iOS 18.7.10 on the iPhone XS, XR and iPad 7th generation, and enforce a minimum OS version.
3. Check Macs with sw_vers -productVersion and flag Tahoe below 26.3, Sequoia below 15.7.2 and Sonoma below 14.8.2.
4. On Linux, update WebKitGTK or WPE WebKit to 2.50.4 or later, which also covers CVE-2025-43529.
5. Turn on Lockdown Mode for high-risk users and for devices that cannot update.

### How to check if you are affected

- Collect a sysdiagnose and search unified logs for entries tagged [DarkSword-WIFI-DUMP] from mediaplaybackd, which iVerify rates high confidence.
- Look for /private/var/tmp/keychain-2.db, /private/var/tmp/wifi_passwords.txt or /private/var/tmp/icloud_dump/ in a forensic extraction.
- Run mvt-ios with iVerify's STIX2 indicators; Safari history is not wiped, so delivery domains such as static.cdncounter[.]net can show up.
- If any indicator matches, get a professional mobile forensics review and treat keychain items, Wi-Fi passwords, messages and wallets as exposed.

## What happened

On March 18, 2026, Google's Threat Intelligence Group, with Lookout and iVerify, published its [DarkSword report](https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain): a six-bug chain that takes over iPhones on iOS 18.4 through 18.7 from a web page. Its zero-day JavaScriptCore bug, [CVE-2025-43529](https://www.cve.org/CVERecord?id=CVE-2025-43529), has its own brief. This one covers the four other Apple bugs, all now in KEV:

- [CVE-2025-31277](https://www.cve.org/CVERecord?id=CVE-2025-31277): the JavaScriptCore entry point for devices below iOS 18.6, which Google calls "a JIT optimization/type confusion bug." [iOS 18.6](https://support.apple.com/en-us/124147), Sequoia 15.6 and Safari 18.6 fixed it on July 29 and 30, 2025, crediting outside researchers. It was not a zero-day.
- [CVE-2025-43510](https://www.cve.org/CVERecord?id=CVE-2025-43510): an XNU copy-on-write bug used to escape from the GPU process into `mediaplaybackd`.
- [CVE-2025-43520](https://www.cve.org/CVERecord?id=CVE-2025-43520): a kernel race in XNU's file system code that gives kernel memory read and write. Both kernel bugs were fixed in [iOS 26.1](https://support.apple.com/en-us/125632) and macOS on November 3, 2025, and in [iOS 18.7.2](https://support.apple.com/en-us/125633) on November 5. Apple listed them on December 12.
- [CVE-2026-20700](https://www.cve.org/CVERecord?id=CVE-2026-20700): a `dyld` pointer-authentication bypass. [iOS 26.3](https://support.apple.com/en-us/126346) and [macOS Tahoe 26.3](https://support.apple.com/en-us/126348) fixed it on February 11, 2026. Apple says it "may have been exploited in an extremely sophisticated attack" and credits Google's Threat Analysis Group.

CISA added CVE-2026-20700 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20700) on February 12, 2026, and the other three ([1](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277), [2](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43510), [3](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43520)) on March 20. CISA's ADP scores CVE-2025-31277 at 8.8 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-31277)); [CVE-2025-43510](https://nvd.nist.gov/vuln/detail/CVE-2025-43510) and [CVE-2026-20700](https://nvd.nist.gov/vuln/detail/CVE-2026-20700) score 7.8. Google saw the chain from November 2025 with UNC6748 in Saudi Arabia, customers of Turkish vendor PARS Defense, and UNC6353 on Ukrainian sites. On March 23, [TechCrunch](https://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/) reported a newer version leaked on GitHub. iVerify's Matthias Frielingsdorf said: "The exploits will work out of the box."

## Who is affected

iOS 18 before 18.7.2 and iOS 26 before 26.3, Macs on Tahoe before 26.3, Sequoia before 15.7.2 or Sonoma before 14.8.2, and WebKitGTK or WPE WebKit before 2.50.0 ([WSA-2026-0001](https://webkitgtk.org/security/WSA-2026-0001.html)). No iOS 18 or Sequoia note lists CVE-2026-20700. On April 1, 2026, Apple offered [iOS 18.7.7](https://support.apple.com/en-us/126793) to more devices, saying "The fixes associated with the DarkSword exploit first shipped in 2025."

## Do you really need to act?

Most fleets do not: [current builds](https://support.apple.com/en-us/100100) are iOS 26.7.1, 27.0.1 and 18.7.10. The risk is an iPhone that stayed on early iOS 18 with automatic updates off. In March, [iVerify](https://iverify.com/blog/darksword-ios-exploit-kit-explained) estimated up to 270 million exposed devices. With public code, attackers need no skill. iVerify says the exploits fail under Lockdown Mode without extra bypasses.

## What to do now

1. Pull an MDM report. Flag iOS 18 below 18.7.3 and iOS 26 below 26.3.
2. Update to iOS 26.7.1 or 27.0.1, or 18.7.10 on the iPhone XS and XR.
3. On Macs, run `sw_vers -productVersion`.
4. On Linux, update WebKitGTK or WPE WebKit to 2.50.4 or later.
5. Turn on Lockdown Mode where updating is impossible.

## How to tell if you were hit

iVerify rates unified log entries tagged `[DarkSword-WIFI-DUMP]` from `mediaplaybackd` as high confidence; collect a sysdiagnose and search it. Look for `/private/var/tmp/keychain-2.db`, `/private/var/tmp/wifi_passwords.txt` and `/private/var/tmp/icloud_dump/`. Safari history is not wiped, so run `mvt-ios check-backup --iocs darksword.stix2 --output ./out ./backup` with iVerify's indicators. If anything matches, get a forensics review and treat keychain items, messages and wallets as exposed.

## Timeline

- Jul 29, 2025 — iOS 18.6 fixes CVE-2025-31277.
- Nov 3, 2025 — iOS 26.1 fixes both kernel bugs; iOS 18.7.2 follows Nov 5.
- Feb 11, 2026 — iOS 26.3 fixes CVE-2026-20700; KEV follows Feb 12.
- Mar 18, 2026 — Google, iVerify and Lookout publish DarkSword.
- Mar 20, 2026 — CISA adds the other three to KEV.
- Mar 23, 2026 — TechCrunch reports the GitHub leak.
- Apr 1, 2026 — Apple widens iOS 18.7.7.

## Sources

1. [Apple — About the security content of iOS 18.6 and iPadOS 18.6](https://support.apple.com/en-us/124147)
2. [Apple — About the security content of iOS 26.1 and iPadOS 26.1](https://support.apple.com/en-us/125632)
3. [Apple — About the security content of iOS 18.7.2 and iPadOS 18.7.2](https://support.apple.com/en-us/125633)
4. [Apple — About the security content of iOS 26.3 and iPadOS 26.3](https://support.apple.com/en-us/126346)
5. [Apple — About the security content of macOS Tahoe 26.3](https://support.apple.com/en-us/126348)
6. [Apple — About the security content of iOS 18.7.7 and iPadOS 18.7.7](https://support.apple.com/en-us/126793)
7. [Apple — Apple security releases](https://support.apple.com/en-us/100100)
8. [CVE record — CVE-2025-31277](https://www.cve.org/CVERecord?id=CVE-2025-31277)
9. [CVE record — CVE-2025-43510](https://www.cve.org/CVERecord?id=CVE-2025-43510)
10. [CVE record — CVE-2025-43520](https://www.cve.org/CVERecord?id=CVE-2025-43520)
11. [CVE record — CVE-2026-20700](https://www.cve.org/CVERecord?id=CVE-2026-20700)
12. [NVD — CVE-2025-31277](https://nvd.nist.gov/vuln/detail/CVE-2025-31277)
13. [NVD — CVE-2025-43510](https://nvd.nist.gov/vuln/detail/CVE-2025-43510)
14. [NVD — CVE-2026-20700](https://nvd.nist.gov/vuln/detail/CVE-2026-20700)
15. [CISA — Known Exploited Vulnerabilities: CVE-2026-20700](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20700)
16. [CISA — Known Exploited Vulnerabilities: CVE-2025-31277](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31277)
17. [CISA — Known Exploited Vulnerabilities: CVE-2025-43510](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43510)
18. [CISA — Known Exploited Vulnerabilities: CVE-2025-43520](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-43520)
19. [CVE record — CVE-2025-43529](https://www.cve.org/CVERecord?id=CVE-2025-43529)
20. [WebKitGTK — Security Advisory WSA-2026-0001](https://webkitgtk.org/security/WSA-2026-0001.html)
21. [Google Threat Intelligence Group — The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors](https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain)
22. [iVerify — DarkSword iOS exploit kit explained](https://iverify.com/blog/darksword-ios-exploit-kit-explained)
23. [TechCrunch — Someone has publicly leaked an exploit kit that can hack millions of iPhones](https://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/)

---
Source page: https://erroneo.us/security/briefs/apple-ios-darksword-cve-2025-31277-43510-43520-2026-20700/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt