iPhone BootROM Vulnerability Opens Door to Full Apple SoC Trust Chain Compromise

A recently disclosed iPhone BootROM vulnerability, dubbed “usbliter8,” highlights a significant flaw in Apple’s SecureROM implementation. This vulnerability allows attackers to compromise the entire trust chain of the Application Processor (AP) on affected devices.

Research published by Paradigm Shift on June 18, 2026, showcases a working exploit that targets Apple A12 and A13 system-on-chips (SoCs).

The exploit exploits a flaw in the USB controller’s Direct Memory Access (DMA) handling, combined with certain firmware misconfigurations. Since BootROM is immutable, this vulnerability cannot be patched through software updates, leaving affected devices permanently exposed.

At the core of the issue is the Synopsys DesignWare USB2 (DWC2) controller used in Apple silicon. The vulnerability arises during USB control transfers, specifically in the handling of Setup packets.

According to the USB specification, each Setup transaction must contain exactly 8 bytes. However, the controller accepts malformed or smaller packets and writes them into memory in 4-byte chunks.

The DMA engine increments its pointer based on the actual data written. However, it resets it to the beginning of the fixed-size packet, introducing a mismatch. This results in a controlled buffer underflow primitive in 12-byte steps, effectively allowing attackers to overwrite adjacent memory regions.

The flaw becomes exploitable because Apple configured the DMA address register (DOEPDMA). Instead of acting as a static buffer pointer, it behaves as a dynamic source of truth, incrementing after each write.

On A12 and A13 devices, the absence of proper DART (Device Address Resolution Table) protections in SecureROM further enables unrestricted memory writes, including sensitive SRAM regions. Earlier chips like A11 mitigate this via manual DMA resets, while newer generations (A14 and later) configure DART correctly, preventing exploitation.

Achieving program counter (PC) control differs across chipsets. On A12, attackers can overwrite the saved link register (LR) on the USB task stack due to a favorable memory layout, enabling straightforward control-flow hijacking.

A13 introduces Pointer Authentication (PAC), complicating direct exploitation. Researchers bypassed this by chaining multiple primitives, including heap corruption, controlled zero writes, and manipulation of critical system structures. One notable primitive is derived from the DART cleanup routine:

This primitive enables controlled zeroing of memory, which is later used to neutralize heap protections and manipulate execution flow. By carefully timing DMA writes and exploiting task scheduling behavior, attackers avoid corrupting critical registers while still achieving arbitrary memory overwrite.

Once PC control is obtained, the exploit pivots to SecureROM privilege escalation. Although SecureROM primarily operates in EL0, specific instructions, such as “SVC 0,” allow temporary transitions to EL1.

The exploit targets a boot trampoline function, injecting shellcode into executable memory via DMA and bypassing signature checks. On A12, this is achieved using a minimal ROP chain, while A13 requires more advanced techniques due to PAC enforcement.

Post-exploitation capabilities are significant. The attacker can modify the boot process, inject custom USB handlers, and enable the execution of unsigned iBoot. The exploit also introduces custom DFU commands, including “demotion” (lowering device security state) and arbitrary booting of firmware images.

Although it does not directly compromise the Secure Enclave Processor (SEP), the attack weakens system-wide trust boundaries and may facilitate further attacks.

Importantly, the vulnerability highlights a broader class of hardware-level flaws that persist across device lifecycles. Since BootROM cannot be updated, the only mitigation is hardware replacement.

Paradigm Shift confirmed coordinated disclosure with Apple, and while newer devices are not affected, millions of A12 and A13-based devices remain vulnerable.

The usbliter8 research underscores a critical reality in modern mobile security: even advanced mitigations like PAC and secure boot chains can be undermined by subtle hardware design flaws.

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

INC has matured from an emerging RaaS operation into one of 2026’s most active ransomware…

A previously undocumented, modular Linux post‑exploitation framework that demonstrates sophisticated stealth techniques most notably fetching…

A novel Windows-based cryptocurrency clipper that has been active since February 2026 and leverages Windows…

Hackers are actively exploiting a compromised Klue Battlecards integration to extract sensitive Salesforce CRM data…

A new state-surveillance assessment finds that foreign travelers and business staff face high or very…

International law enforcement agencies have successfully seized 106 servers and 101 domains as part of…