New iPhone BootROM Vulnerability Exposes Apple SoCs to Full Chain-of-Trust Compromise
A hardware-level BootROM vulnerability in Apple A12, S4/S5, and A13 SoCs allows attackers to achieve full boot-chain compromise, bypassing all signature verification and Secure Boot protections.
Researchers from Paradigm Shift have disclosed a critical BootROM vulnerability, dubbed usbliter8, that affects Apple devices powered by A12, S4/S5, and A13 SoCs. The flaw resides in the Synopsys DWC2 USB controller and, when combined with a misconfigured DART (Device Address Resolution Table) in SecureROM, enables full application processor boot-chain compromise. Because BootROM code is immutable in silicon, no software or firmware patch can remediate the issue; only migrating to A14 or later hardware mitigates the flaw.
The vulnerability originates in how the DWC2 USB controller handles consecutive USB Setup packets. The controller stores up to three packets in memory before resetting the DMA base address (stored in the DOEPDMA register) to its starting position, functioning like a ring buffer. After each write, the controller increments DOEPDMA by the size of data written, but the reset operation always decrements it by a fixed 24 bytes. Since the controller also accepts smaller packets stored in 4-byte chunks, the pointer arithmetic breaks down. The mismatch between the variable increment and the fixed decrement produces a buffer underflow primitive in 12-byte steps, allowing controlled writes to memory regions outside the intended buffer.
On A12 and S4/S5, exploitation is relatively straightforward. The DMA buffer sits adjacent to the USB task's stack on the heap. Attackers corrupt a saved Link Register (LR), gaining PC control during a scheduler context switch. A compact ROP chain then redirects DMA writes into the boot trampoline normally non-writable from EL0 before jumping into SecureROM's EL1 transition routine to execute attacker shellcode with full privileges. A13 introduces Pointer Authentication (PAC), complicating direct LR corruption. Researchers developed a multi-step technique involving controlled overwrites of DART heap metadata, neutralizing heap checksum protections, and suppressing reboots on panic by overwriting a global panic counter with a 0xF write primitive. Execution is ultimately rerouted through a gadget that loads a function pointer from attacker-controlled memory, bypassing PAC because only the IB key is enabled in the firmware—an oversight that proves fatal.
With EL1 code execution achieved, the exploit injects a custom USB request handler into unused boot trampoline space, patches the USB serial number to include the "PWND" identifier, and restores corrupted heap allocations to maintain device stability. On A13, the extent of memory corruption requires a full SecureROM restart: researchers copy the ROM into SRAM, remap it via custom MMU translation tables, and hook ROM PTE generation to maintain address space consistency through the restart. The custom handler supports two privileged operations: SoC demotion (temporarily lowering production mode) and unsigned iBoot booting (bypassing all signature verification on raw iBoot images), effectively nullifying Apple's Secure Boot chain.
Confirmed vulnerable SoCs include: Apple A12 (iPhone XS, XR, iPad Pro 2018), Apple S4/S5 (Apple Watch Series 4/5), and Apple A13 (iPhone 11 series). Because BootROM vulnerabilities reside in immutable silicon, no software or firmware update can remediate the issue. Migrating to A14 or later hardware remains the only effective mitigation. Researchers note that Apple's Secure Enclave Processor (SEP) provides an additional security boundary, though usbliter8 opens broader vectors to attack the Secure Enclave indirectly.
Paradigm Shift coordinated disclosure with Apple Product Security prior to publication. The full proof-of-concept exploit is publicly available in their research repository. This discovery underscores the growing challenge of securing hardware-level trust chains, where a single silicon flaw can render even the most sophisticated software defenses powerless.
Researchers at Paradigm Shift have released a full proof-of-concept for the exploit, dubbed "usbliter8," which targets the Synopsys DesignWare USB controller in Apple's A12 and A13 SoCs. The vulnerability allows unsigned code execution during DFU mode and the loading of custom iBoot images without signature checks, marking compromised devices with the traditional "PWND" string. While the exploit requires physical access and does not compromise the Secure Enclave Processor, it represents a permanent break in the boot chain for affected iPhone XS, XR, 11, and 11 Pro models, as the flaw is burned into silicon.
Researchers at Paradigm Shift have now released a working exploit named 'usbliter8' that achieves arbitrary code execution inside the SecureROM of A12 and A13 chips, confirming the vulnerability is burned into silicon and cannot be patched via software updates. The exploit requires physical USB access, limiting it to a local attack vector, but it completely breaks the boot chain trust model for affected iPhones and iPads. This public proof-of-concept demonstrates that the previously theorized BootROM flaw is fully exploitable in practice.
Paradigm Shift has released a proof-of-concept exploit called Usbliter8 that targets the same BootROM vulnerability, chaining a USB controller bug and a device firmware configuration weakness to achieve full code execution at the device's lowest level. The exploit requires physical USB access and works against iPhones with A12 and A13 chips (iPhone XS, XR, 11) and Apple Watches with S4 and S5 chips. Apple has not publicly responded to the disclosure, and the vulnerability remains unpatchable via software update.
Paradigm Shift's new analysis, published on June 22, 2026, provides the first detailed technical breakdown of the exploit, which it has named 'usbliter8.' The attack chain combines a hardware vulnerability in the Synopsys DesignWare USB controller with a firmware configuration flaw in SecureROM, allowing undersized USB packets to cause a DMA pointer underflow that overwrites SecureROM SRAM. On A12 and S4/S5 devices, the exploit corrupts the link register to gain code execution; on A13, it bypasses Pointer Authentication via heap manipulation and interrupt handler overwrite. The researchers confirmed that A14 and later chips are not affected due to corrected DART configuration, but warned that affected devices will carry the unpatchable flaw for their lifetime.