DarkSword Exploit: Six-Bug iOS Chain Forces Apple’s Emergency Patch

A Website Visit Is All It Takes

A routine website visit. That is all it takes. The DarkSword exploit kit chains together six vulnerabilities spanning WebKit, Safari, the dynamic loader, and the iOS kernel to achieve full device compromise from a single browser interaction. No clicks required beyond the initial page load. No user interaction after landing on a compromised website.

The exploit chain, publicly documented in March 2026 by Google’s Threat Intelligence Group alongside iVerify and Lookout, forced Apple into a rare emergency patch cycle, ultimately expanding fixes to iOS 18.7.7 on April 1, 2026. Google confirmed the kit had been adopted by multiple threat actors, including a Turkish commercial surveillance vendor, a threat group designated UNC6748, and a suspected Russian espionage group tracked as UNC6353.

The Six Vulnerabilities

DarkSword’s power comes from chaining six distinct vulnerabilities into a seamless attack path. Three are zero-days.

CVE-2025-31277 — JavaScriptCore Memory Corruption. The entry point. A memory corruption flaw in JavaScriptCore, the JavaScript engine underlying all WebKit-based browsers on iOS. Visiting a malicious webpage triggers initial code execution within the browser sandbox.

CVE-2025-43529 — JavaScriptCore Memory Corruption. A second JavaScriptCore flaw used to stabilize the exploit and achieve reliable code execution. Two separate JavaScriptCore bugs suggest the developers had deep knowledge of WebKit internals.

CVE-2025-14174 — ANGLE Memory Corruption. A flaw in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by WebKit for GPU-accelerated rendering, providing a pathway to lower-level system components.

CVE-2026-20700 — dyld PAC Bypass. The critical pivot. This vulnerability in dyld, the iOS dynamic loader, bypasses Apple’s Pointer Authentication Codes — hardware-level security introduced with the A12 chip in 2018 specifically to prevent exploit chains like DarkSword.

CVE-2025-43510 — iOS Kernel Memory Management. A kernel flaw enabling privilege escalation from user space to kernel space.

CVE-2025-43520 — iOS Kernel Memory Corruption. The final link achieving persistent kernel-level access and complete device control.

From Browser to Full Compromise

The attack executes in seconds. JavaScriptCore vulnerabilities achieve code execution within Safari’s sandbox. The ANGLE flaw escapes the sandbox into user space. The dyld vulnerability defeats PAC hardware protections. Two kernel vulnerabilities escalate to ring 0 access. With kernel-level control, attackers can install persistent implants, exfiltrate data, activate microphones and cameras, and intercept encrypted communications.

The victim sees nothing unusual — perhaps a brief page load delay.

Three Threat Groups, Four Countries

Google’s Threat Intelligence documented PARS Defense, the Turkish commercial surveillance vendor, using DarkSword since at least November 2025 in campaigns targeting users in Turkey and Malaysia. PARS applied sophisticated OPSEC including ECDH and AES encryption between server and victim. The payload delivered was GHOSTSABER, a JavaScript backdoor capable of device enumeration, file listing, data exfiltration, and arbitrary code execution.

Google identified three distinct malware families deployed after DarkSword compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER — each associated with different threat actors. Campaigns have been observed targeting Saudi Arabia, Turkey, Malaysia, and Ukraine.

The eventual leak of proof-of-concept code to GitHub accelerated proliferation, potentially exposing the technique to less sophisticated attackers. What was exclusive to surveillance vendors is becoming available to cybercriminals.

Apple’s Emergency Response

Apple’s response unfolded in stages. iOS 26 users received patches through the regular iOS 26.3 update cycle. For the hundreds of millions of devices running iOS 18, Apple first released iOS 18.7.7 on March 24 to a limited set of older devices (iPhone XS, XR, 7th-gen iPad), then expanded availability to all supported devices on April 1, 2026.

The multi-week patching timeline highlights a structural challenge: device version diversity and slow OS upgrade adoption create a long tail of vulnerable devices. DarkSword specifically targets iOS 18.4 through 18.7, versions running on the majority of active iPhones worldwide.

The PAC Bypass Changes the Calculus

The most technically significant element is the PAC bypass (CVE-2026-20700). Apple introduced Pointer Authentication Codes with the A12 chip as hardware-level defense against code reuse attacks. PAC signs return addresses and function pointers with cryptographic codes, theoretically preventing attackers from redirecting execution even after achieving memory corruption.

DarkSword’s bypass demonstrates that hardware mitigations, while raising the bar significantly, are not impregnable. This has implications beyond Apple: Intel’s CET, ARM’s MTE, and other hardware security features follow the same paradigm. DarkSword shows these defenses add cost and complexity for attackers but do not eliminate the threat.

Lessons for Enterprise Security

Patch velocity is critical. The window between active exploitation and comprehensive patching spanned months. Organizations enforcing rapid OS updates significantly reduce exposure.

MDM must enforce OS versions. Mobile Device Management solutions that allow indefinite update deferral create persistent vulnerability. Enterprise policies should mandate current or current-minus-one OS versions.

Web browsing is an attack surface. DarkSword’s delivery through compromised legitimate websites bypasses phishing-focused defenses. Mobile threat defense solutions that detect exploit kit activity at the network or device level should be evaluated.

Assume breach for high-value targets. Organizations whose personnel may be targeted by commercial surveillance vendors should implement device rotation, compartmentalized communications, and regular forensic inspections.

Sources & Further Reading

• The Proliferation of DarkSword: iOS Exploit Chain — Google Cloud Blog
• DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days — The Hacker News
• Apple Expands DarkSword Patches to iOS 18.7.7 — Malwarebytes
• DarkSword: iPhone Exploit Kit Serves Spies and Thieves Alike — Dark Reading
• CVE-2026-20700: Apple Patches Zero-Day — SOC Prime
• DarkSword Exploit Chain Leaked Online — Cybersecurity News
• Apple Releases iOS 18.7.7 for DarkSword Protection — gHacks