Apple says it will fix a flaw that crashes Messages app on iOS upon receipt of a malicious link in an update next week
but a fix is coming Christian Zibreg / iDownloadBlog.com : A fix for ChaiOS Messages bug will arrive next week Henry T. Casey / Tom's Guide : Apple Promises Fix for ChaiOS Text Bomb Christian Zibreg / iDownloadBlog.com : ChaiOS “text bomb” can crash your iPhone, iPad or Mac with a single malicious link Avery Hartmans / Business Insider : A malicious link is being sent around that freezes your iPhone even if you don't click on it … Tweets: Abraham Masri / @cheesecakeufo : Effective Power is back, baby! chaiOS bug: Text the link below, it will freeze the recipient's device, and possibly restart it. http://iabem97.github.io/chaiOS Do not use it for bad stuff. — thanks to @aaronp613 @garnerlogan65 @lepidusdev @brensalsa for testing!
Context & Ripple Effects
This is the third time in under three years that a crafted string has taken down Apple's Messages app. The 2015 'Effective Power' text bug crashed iPhones on receipt via iMessage or SMS, and spread within days to Snapchat chats and Twitter DMs before Apple shipped a temporary fix two days later; in 2016 Apple again acknowledged link-tapping crashes and folded a researcher-proposed mitigation into iOS 9.3.
ChaiOS, disclosed by developer Abraham Masri, revives the same attack shape — a malicious link that freezes or restarts the recipient's device without any tap — and lands against a Messages stack Apple has since tried to harden architecturally, though its Blastdoor-style protections were themselves partially defeated by CoreGraphics and WebKit flaws patched in 2021.
First-order effects
- iPhone, iPad and Mac users who receive the chaiOS link in Messages have their app crash or device freeze even without clicking, making every incoming message a potential denial-of-service vector until Apple's update lands next week.
- Apple must rush a point release across iOS and macOS, repeating the emergency-patch cadence it used for the 2015 text bug rather than waiting for a scheduled OS drop.
Second-order effects
- As with the 2015 bug's spread through Snapchat and Twitter DMs, other messaging platforms handling the same link format face pressure to filter or sanitize the string on their own servers while Apple's fix is pending.
- Security researchers gain another worked example that crafted message payloads beat consumer-grade input validation, lowering the bar for copycat variants that arrive faster than Apple's weekly patch cycle.
Third-order effects
- If the pattern holds — 2015, 2016, 2018 — Apple's response will keep shifting from one-off patches toward architectural isolation of message parsing, but each defeat of those defenses shows that rendering untrusted content remains a structural weak point no single update closes.
- Repeated receipt-triggered crashes erode the reliability argument that separates integrated platforms from rivals, giving competitors and regulators alike a concrete data point in debates over platform accountability.
The trend: Messaging apps keep turning untrusted received content into device-level crashes, forcing Apple into a cycle of emergency patches and hardened parsing layers that attackers repeatedly route around.