Google Project Zero researchers publish details and demo exploit code for five of six “interactionless” iOS security bugs; iOS 12.4 patched all but one of them
The six bugs, if sold on the black market, would have brought in well over $5 million.
Context & Ripple Effects
Google Project Zero followed its standard disclosure playbook: once Apple shipped iOS 12.4 with fixes for five of six "interactionless" bugs, the team published technical details and working demo exploits, holding back only the one flaw Apple left unpatched. ZDNet pegs the six bugs' combined black-market value at well over $5 million, which is what made the release a deliberate act of devaluation against exploit brokers.
The publication also seeded the record that Project Zero itself drew on weeks later, when it documented how five iOS exploit chains had been weaponized in watering hole attacks against websites hitting devices on iOS 10 through 12.
First-order effects
- iPhone and iPad users on versions before iOS 12.4 are immediately exposed to publicly documented, reproducible attacks that require no user interaction, while buyers of these exploits on the gray market see their inventory lose exclusivity and resale value.
- Apple faces direct pressure to close the sixth, still-unpatched bug now that its five siblings have public proof-of-concept code pointing attackers at the same attack surface.
Second-order effects
- Operators running the watering hole campaigns Project Zero later dissected are forced to retool around patched components or race to compromise devices before users update, raising the operating cost of stockpiled iOS chains.
- Security vendors and defenders gain working exploit code they can use to build detections, narrowing the advantage that private brokerages pay millions to keep.
Third-order effects
- The episode is an early data point in the shift toward no-interaction mobile exploitation that continued with the zero-click AWDL protocol exploit detailed in 2020 and the three iOS zero-days still exploitable in iOS 15 despite being reported months earlier — a pattern suggesting Apple's patch pipeline, not researcher discovery, is becoming the bottleneck.
- If high-value interactionless chains keep surfacing through coordinated disclosure, gray-market pricing should increasingly favor freshly discovered flaws over aging stockpiles, structurally rewarding faster finders.
The trend: Mobile exploitation is migrating toward zero-click attack surfaces, with public coordinated disclosure increasingly setting both the price of exploit inventories and the pace of Apple's patches.