Apple Zero-Day Vulnerabilities: Sophisticated Attacks Target Specific Individuals via iOS

Apple released critical updates for iOS, iPadOS, macOS, and visionOS on Wednesday, April 16, 2025, addressing two zero-day vulnerabilities exploited in attacks categorized as "extremely sophisticated" against specific individuals. These flaws, identified as CVE-2025-24200 and CVE-2025-24201, allowed attackers to disable hardware protections and escape the WebKit browser sandbox, respectively. The company states that the attacks required physical access to the devices and targeted users of earlier iOS 17.2 versions, suggesting a coordinated operation by actors with advanced technical resources, possibly linked to government agencies or surveillance groups.

Technical Details of the Vulnerabilities

CVE-2025-24200: USB Restricted Mode Bypass

The first vulnerability, discovered by Bill Marczak of Citizen Lab, exploited a flaw in iOS’s authorization state management. The USB Restricted Mode, a feature introduced in 2018 to block data transfers via cable after seven days of device inactivity, was compromised, allowing attackers with physical access to bypass the protection even on locked devices. This would facilitate unauthorized data extraction through forensic tools like Cellebrite or GrayKey, widely used by law enforcement agencies.

CVE-2025-24201: WebKit Sandbox Escape

The second flaw resided in the WebKit rendering engine, used by Safari and other applications. By processing malicious content, attackers could breach the Web Content Sandbox, an isolated environment that limits access to system resources. The exploitation would allow remote code execution (RCE), privilege escalation, and potential complete device control. Apple had patched similar vulnerabilities in previous updates, but the recurrence suggests ongoing challenges in containing targeted threats.

Context of Exploits: Targets and Methods

Victim Profile

Although Apple does not identify the targets, reports from Citizen Lab and Amnesty International associate similar exploits with surveillance campaigns against journalists, activists, and political dissidents. For instance, in 2024, Serbian authorities used forensic tools to hack human rights defenders' devices, installing malware after unlocking the devices. Apple's choice of the term "specific individuals" indicates a focus on high-value profiles whose activities attract government or corporate interest.

Modus Operandi of Attacks

Attackers relied on physical access to devices, possibly obtained through seizure or theft. Once connected to a forensic unlocking device, the USB Restricted Mode exploit allowed bypassing time-based protections (such as auto restart after 72 hours) and extracting sensitive data. Simultaneously, the WebKit vector could be activated remotely via malicious links, extending the risk beyond physical contact.

Impact on Apple Device Security

Chronic Vulnerabilities in the iOS Ecosystem

This is the third zero-day fixed by Apple in 2025, following critical flaws reported in January and February. The recurrence exposes dilemmas between the complexity of iOS and the pressure for innovations. Tools like the Lockdown Mode, launched in 2022 to protect at-risk users, have proven insufficient against hardware exploits.

Implications for User Trust

The revelation that even locked devices can be breached shakes the perception of absolute security associated with Apple. Organizations relying on iPhones for confidential communications, such as governments and NGOs, face dilemmas about adopting additional measures, such as completely disabling physical ports or migrating to alternative systems.

Responses and Mitigation Measures

Apple's Updates and Fixes

The iOS 18.3.2, iPadOS 18.3.2, and macOS Sequoia 15.3.2 versions include fixes for both vulnerabilities. The company recommends that all users update their devices immediately, especially those in vulnerable groups. Additionally, Safari 18.3.1 received adjustments to WebKit's sandbox to prevent future escapes.

Recommendations for High-Risk Users

• Disable physical connections: Use settings to block Lightning/USB-C ports when not in use.
• Monitor suspicious activity: Tools like Lockdown Mode log unauthorized access attempts.
• Avoid outdated versions: Devices incompatible with iOS 17.2 or later are permanently exposed.

Conclusion: A Call for Continuous Vigilance

The sophistication of recent attacks underscores the need for proactive mobile security approaches. While Apple continues to lead in rapid responses to threats, the targeted nature of these exploits reveals a landscape where even "secure-by-default" manufacturers are under constant test. For ordinary users, the lesson is clear: immediate updates are the first line of defense. For high-profile targets, a combination of hardware, software, and operational caution remains essential.

As governments debate regulations on forensic tools and zero-days, the security community awaits the next round in this cat-and-mouse game. The question that remains is: how many flaws are left before the next generation of exploits redefines the boundaries of digital privacy?

Image credit:
Jaap Arriens/NurPhoto / Getty Images