On June 18, 2026, security researchers from Paradigm Shift released a working exploit named usbliter8, which enables arbitrary code execution within the SecureROM of Apple's A12 and A13 chips. The exploit requires physical access to the device, which must be in DFU mode and connected to a specialized RP2350-based microcontroller board via USB. Once connected, the exploit can be executed in less than two seconds.
The vulnerability affects several devices, including the iPhone XS, XS Max, XR, 11, 11 Pro, 11 Pro Max, and SE (2nd generation), as well as various models of iPads and Apple Watches. Although A12X and A12Z support is theoretically possible, it has not yet been implemented. Devices powered by A11 or later are not susceptible to this exploit.
This issue stems from a hardware flaw in the Synopsys DWC2 USB controller, which allows a buffer underflow condition due to a mismatch in how incoming USB packets are processed. The vulnerability is exacerbated by Apple’s configuration of the USB Device Address Resolution Table, which permits unauthorized access to SRAM memory.