AirDrop and Quick Share flaws expose billions of devices to nearby attacks

Researchers at the CISPA Helmholtz Center for Information Security disclosed six proximity-based vulnerabilities in Apple AirDrop and Google/Samsung Quick Share that could be exploited by attackers within wireless range or on the same local network. The issues include three denial-of-service flaws in AirDrop affecting privileged sharing and parsing components on macOS and iOS, two authentication and encryption bypass flaws in Samsung's Quick Share on Android, and a use-after-free bug in Google's Quick Share client for Windows that could potentially be exploitable. The findings show that both ecosystems expose significant pre-authentication attack surfaces despite using different implementations.

Apple has reportedly fixed one AirDrop flaw and assigned a non-public CVE, while Google has patched the Windows Quick Share bug and issued a bounty, with its CVE still pending. The remaining Apple issues and the Samsung Quick Share flaws are still under coordinated disclosure or investigation, and no in-the-wild exploitation has been reported. Researchers also released a custom fuzzer, crash scripts, and protocol notes to help validate the bugs and support further testing across nearby-sharing features used on roughly five billion devices.