Sale of an iOS exploit chain

For informational purposes only.

Vulnerable devices: iPhone 8 / 8 Plus / X Vulnerable versions: Apple iOS 16.7.x (all builds up to 16.7.16)

According to the author, a private exploit chain exists for Intel-based devices. The attack is launched through the Safari browser after the user visits a specially crafted link. The malicious code bypasses SPTM and PAC protections by exploiting weaknesses in Intel's less secure sandbox. The vulnerability does not yet have a CVE number, public description, or patch and is not associated with any known exploits. If the attack succeeds, the attacker can gain full control of the device, maintain access to it, and remotely extract data.

Price: $8000