Apple’s SecureROM boots the device before any operating system code runs, making it the root of trust for iPhone, iPad and Watch platforms. In June 2026, Paradigm Shift published usbliter8, a tethered exploit that breaks the SecureROM of Apple’s A12 and A13 SoCs as well as the Watch S4/S5 chips [1]. The attack combines a hardware under‑flow bug in the Synopsys DesignWare DWC2 USB controller with a firmware configuration mistake that leaves the device‑address‑resolution‑table (DART) in bypass mode, allowing DMA writes to reach arbitrary SRAM.

The USB controller bug

The DWC2 stores up to three USB Setup packets in a DMA buffer. On the fourth packet the controller resets its write pointer by subtracting 24 bytes from the DOEPDMA register, regardless of the actual packet size. Because the controller increments DOEPDMA in 4‑byte steps, a crafted sequence of small packets produces a 12‑byte under‑flow primitive that can write before the allocated buffer [2]. This flaw is inherent to the controller and, while potentially present on many devices, is exploitable only when the firmware leaves the DART in bypass, as seen on A12/A13 [1][3].

Gaining PC control

On A12 the DMA buffer sits directly after the USB task’s stack on the heap. By overwriting the saved link‑register (LR) on that stack, the exploit forces a context‑switch to a controlled address, achieving full code execution in SecureROM [1]. A13 adds Pointer Authentication (PAC), which protects stack‑stored LR values. The researchers bypass PAC by corrupting heap‑metadata and a global panic counter, then manipulate the task‑structure’s critical‑section depth to trigger a panic that redirects execution to a crafted interrupt‑handler pointer [1].

Post‑exploitation chain

Once execution reaches SecureROM, the code runs in EL0 but can elevate to EL1 via a hidden SVC 0 instruction placed in the iBoot hand‑off routine. The exploit rewrites the DMA destination to the boot‑trampoline area, writes a small ROP shellcode via the DMA under‑flow, sleeps (~400 ms) to allow the write to complete, then jumps to the trampoline’s SVC 0 entry point [1]. The payload restores the original boot‑trampoline, patches the ROM to keep the device in DFU mode, injects a custom USB request handler, and even adds a PWND tag to the serial‑number string. The handler can demote the device’s production mode and boot unsigned iBoot images, effectively breaking Apple’s code‑signing chain without touching the Secure Enclave Processor [1].

Business impact

  • Persistent risk – Because the vulnerability lives in immutable ROM, firmware updates cannot fix it; only a hardware refresh mitigates the issue. Enterprises with deployed iPhone XS‑through‑11 fleets must plan for eventual hardware replacement.
  • Supply‑chain threat – An attacker with physical access could modify devices in‑field or during refurbishment, inserting persistent backdoors that survive OS reinstalls.
  • Compliance implications – Regulations that require trustworthy boot processes (e.g., GDPR‑related data integrity, NIST 800‑63) may be hard to satisfy for affected models.
  • Cost of mitigation – Organizations may need to allocate budget for device‑level asset tracking, secure storage, and accelerated refresh cycles, potentially adding $30–$50 per device in operational expense.

Mitigations and roadmap

Apple’s later generations (A14+) correctly configure DART, rendering the under‑flow ineffective. For A12/A13 devices, the only reliable mitigation is hardware replacement or moving critical workloads to newer devices. In the meantime, enterprises should enforce strict physical‑access controls, monitor DFU‑mode