Loading story…
Researchers at the CISPA Helmholtz Center for Information Security disclosed six proximity-based vulnerabilities in Apple AirDrop and Google/Samsung Quick Share that could be exploited by attackers within wireless range or on the same local network. The issues include three denial-of-service flaws in AirDrop affecting privileged sharing and parsing components on macOS and iOS, two authentication and encryption bypass flaws in Samsung's Quick Share on Android, and a use-after-free bug in Google's Quick Share client for Windows that could potentially be exploitable. The findings show that both ecosystems expose significant pre-authentication attack surfaces despite using different implementations.
Apple has reportedly fixed one AirDrop flaw and assigned a non-public CVE, while Google has patched the Windows Quick Share bug and issued a bounty, with its CVE still pending. The remaining Apple issues and the Samsung Quick Share flaws are still under coordinated disclosure or investigation, and no in-the-wild exploitation has been reported. Researchers also released a custom fuzzer, crash scripts, and protocol notes to help validate the bugs and support further testing across nearby-sharing features used on roughly five billion devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly disclosed the six nearby-sharing vulnerabilities affecting AirDrop and Quick Share. They also released a custom fuzzer, crash scripts, and protocol notes to support validation and further testing.
Google landed a fix for the Quick Share for Windows use-after-free vulnerability. The associated CVE was still pending publicly, and Google had also paid a bounty for the finding.
Apple fixed one of the identified AirDrop vulnerabilities and assigned it a CVE identifier that had not yet been made public. The remaining Apple AirDrop issues were still under coordinated disclosure or investigation.
Researchers at the CISPA Helmholtz Center for Information Security identified six proximity-based vulnerabilities affecting Apple AirDrop and Google/Samsung Quick Share across macOS, iOS, Android, and Windows. The issues include AirDrop denial-of-service flaws, Quick Share authentication and encryption bypasses on Android, and a use-after-free in Quick Share for Windows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has introduced a new feature that enables its Android Quick Share tool to interoperate with Apple’s AirDrop, allowing file sharing between the two platforms for the first time. This functionality is currently limited to Google’s Pixel 10 smartphone and requires iOS users to enable the 'Everyone for 10 minutes' mode on AirDrop, which temporarily makes their device discoverable to anyone nearby. Both companies have highlighted the convenience of cross-platform sharing, but security concerns remain, as these modes can expose users to unsolicited or potentially malicious file transfers. Organizations often mitigate these risks by disabling such features through mobile device management solutions. In parallel, Apple is testing a new AirDrop feature in its iOS beta that introduces PIN pairing, allowing users to share files for up to 30 days without needing to be in each other's contacts. This change aims to enhance usability but may also introduce new security considerations, as it extends the window during which devices are open to file sharing from non-contacts. Both developments reflect ongoing efforts by Google and Apple to balance ease of use with the need to protect users from abuse and unauthorized file transfers.
Jun 29, 2026
Apple and Google have released emergency security updates to address zero-day vulnerabilities that were actively exploited in sophisticated attacks targeting users of their platforms. Apple issued patches across its ecosystem—including iPhones, iPads, and Macs—to fix two WebKit bugs, warning that these flaws had been abused in highly targeted attacks against specific individuals. Google, in parallel, released a Chrome Stable channel update to address multiple security flaws, including CVE-2025-14174, an out-of-bounds memory access vulnerability that was already being exploited in the wild. Both companies provided limited technical details but confirmed that the vulnerabilities were under active attack and that coordinated investigation revealed overlap in their findings, with Apple's security team and Google's Threat Analysis Group credited for discovery. Security researchers have noted that these vulnerabilities could be weaponized by commercial spyware vendors, and there is evidence suggesting that the flaws were exploited before patches were available. The urgency of the situation has led to widespread advisories urging users to update their devices immediately to mitigate the risk of compromise. The lack of detailed disclosure from both Apple and Google underscores the sensitive nature of the attacks and the ongoing threat posed by sophisticated adversaries targeting mainstream software platforms used by billions worldwide.
Jun 29, 2026
Apple released security updates for **macOS Tahoe 26.6.1**, **Sequoia 15.7.9**, and **Sonoma 14.8.9** to fix a Screen Sharing vulnerability that could let an attacker on the same network authenticate without valid credentials. The issue appears to primarily affect Macs where Screen Sharing has been explicitly enabled, and Apple said there is no evidence it has been exploited in the wild. Apple also noted that Tahoe 26.6.1 includes broader security fixes available through the standard Software Update mechanism. The updates follow disclosure of **`CVE-2026-39875`**, a CUPS flaw in macOS that allows an unprivileged local user to chain logic bugs in the privileged `cupsd` daemon and gain an arbitrary file-write capability as root. A public proof-of-concept showed how an attacker could register a malicious printer, capture and replay a valid CUPS authentication token, and abuse a `file://` device URI to write to attacker-chosen local paths outside SIP protection. Apple patched affected versions of Sonoma, Sequoia, and Tahoe, and defenders were urged to install updates quickly and watch for suspicious printer registrations, device URI changes, and print jobs targeting file-based destinations.
Aug 12, 2026