Unpatchable ‘usbliter8’ Exploit Breaks Apple A12 and A13 SecureROM

Security researchers at Paradigm Shift have disclosed a working exploit called usbliter8 that can achieve arbitrary code execution inside the SecureROM of Apple’s A12 and A13 chips. Because SecureROM is permanently embedded in silicon, the vulnerability cannot be fixed through a software or firmware update.

The exploit requires physical access to an affected device. The device must be placed in DFU mode and connected over USB to a dedicated RP2350-based microcontroller board. Researchers say the attack can complete in less than two seconds, before Apple’s signed boot chain begins.

The technical details and proof-of-concept code were publicly released on June 18, 2026, following coordinated disclosure with Apple Product Security.

Devices Affected

The public proof of concept supports Apple’s A12, A13, S4 and S5 chips. A12X and A12Z may also be vulnerable, although support has not yet been implemented.

Affected products include the iPhone XS, XS Max, XR, iPhone 11 series, second-generation iPhone SE, iPad Air 3, iPad mini 5, iPad 8, Apple Watch Series 4 and 5, first-generation Apple Watch SE and HomePod mini, along with other devices using these chips.

Apple’s A11 is not affected, while A14 and newer chips appear to prevent this particular attack because of improved DART configuration.

How the Vulnerability Works

The flaw originates in the Synopsys DWC2 USB controller. A weakness in how the controller handles USB Setup packets causes its DMA write pointer to move backward through memory under specific conditions.

On A12 and A13 devices, Apple’s USB DART—the chip’s memory-protection mechanism—is configured in a way that allows the faulty DMA operation to reach and overwrite SRAM.

Researchers were able to turn this memory corruption into code execution. On A12, the attack can overwrite a saved link register and gain control of the program counter. A13 requires additional techniques to bypass Pointer Authentication and manipulate memory structures before ultimately hijacking a USB interrupt handler.

What Attackers Can Do

Once code execution is obtained inside SecureROM, the exploit installs a custom USB request handler and modifies the device’s USB serial string to display PWND:[usbliter8].

Researchers demonstrated that the compromised environment can temporarily demote the SoC’s production mode or boot an unsigned iBoot image without normal signature verification, effectively bypassing Apple’s software boot-chain protections.

The research does not demonstrate a compromise of the Secure Enclave, which remains a separate security boundary. However, the researchers warn that control at the BootROM level could potentially provide new avenues for further attacks.

Why It Cannot Be Patched

Like the well-known checkm8 SecureROM vulnerability disclosed in 2019, usbliter8 resides below the software layer that Apple can update. A firmware update therefore cannot remove the underlying flaw.

As of June 19, 2026, there was no publicly issued CVE, CVSS score, Apple security advisory or CISA alert for usbliter8, and no public evidence of exploitation in the wild.

For ordinary users, the immediate risk remains limited because an attacker needs physical possession of the device, DFU mode and specialized equipment. However, organizations handling sensitive devices face a longer-term hardware security issue.

Security teams should identify A12, A13, S4 and S5 devices in sensitive environments, consider replacing them with newer hardware where appropriate, and exercise caution when connecting such devices to untrusted USB hosts or cables.

With the proof of concept now public, usbliter8 represents a permanent hardware-level security weakness for affected Apple devices.