Researchers Demonstrate Persistent iOS Lockdown Mode Jailbreak via AirDrop PDF on iPhone 18 Pro
Security research firm Calif demonstrated a one-click exploit chain that achieves a persistent jailbreak of iOS Lockdown Mode on an iPhone 18 Pro, triggered by a malicious PDF file delivered via AirDrop. The exploit bypasses Apple's hardened security profile designed to protect high-risk users from state-sponsored attacks, exploiting weaknesses in native document parsing. Most notably, the root-level compromise survives an OS update from iOS 27 to iOS 27.2, meaning standard patching or reboot does not remove the implant. Calif has withheld technical details while coordinating disclosure with Apple and will not release public jailbreak tooling, but the demonstration highlights a serious gap in Apple's highest-assurance defensive mode.
Detalhes técnicos
The attack chain begins when a target accepts an AirDrop file transfer containing a weaponized PDF. Once received, background document parsing engines automatically trigger exploitation without requiring the user to open or interact with the file contents, functioning as a near one-click compromise. The resulting root access persists across firmware updates, indicating the exploit achieves low-level, stable system execution rather than a temporary userland foothold. No CVE identifier or public proof-of-concept has been disclosed.
Remediação
Calif is coordinating with Apple on remediation rather than releasing exploit details or tooling publicly. Users, particularly those relying on Lockdown Mode for high-risk threat protection, are advised to be cautious accepting AirDrop transfers from untrusted sources and to install future iOS security patches as soon as Apple issues a fix.
Linha do tempo
-
Researchers Demonstrate Persistent iOS Lockdown Mode Jailbreak via AirDrop PDF on iPhone 18 Pro
ler a análise desta fonte ocultar
Security research firm Calif demonstrated a one-click exploit chain that achieves a persistent jailbreak of iOS Lockdown Mode on an iPhone 18 Pro, triggered by a malicious PDF file delivered via AirDrop. The exploit bypasses Apple's hardened security profile designed to protect high-risk users from state-sponsored attacks, exploiting weaknesses in native document parsing. Most notably, the root-level compromise survives an OS update from iOS 27 to iOS 27.2, meaning standard patching or reboot does not remove the implant. Calif has withheld technical details while coordinating disclosure with Apple and will not release public jailbreak tooling, but the demonstration highlights a serious gap in Apple's highest-assurance defensive mode.
Technical Details
The attack chain begins when a target accepts an AirDrop file transfer containing a weaponized PDF. Once received, background document parsing engines automatically trigger exploitation without requiring the user to open or interact with the file contents, functioning as a near one-click compromise. The resulting root access persists across firmware updates, indicating the exploit achieves low-level, stable system execution rather than a temporary userland foothold. No CVE identifier or public proof-of-concept has been disclosed.
Remediation
Calif is coordinating with Apple on remediation rather than releasing exploit details or tooling publicly. Users, particularly those relying on Lockdown Mode for high-risk threat protection, are advised to be cautious accepting AirDrop transfers from untrusted sources and to install future iOS security patches as soon as Apple issues a fix.