usbliter8: Unpatchable BootROM Exploit Hits Apple A12, A13

Researchers at Paradigm Shift have published usbliter8, a working exploit that runs arbitrary code inside the SecureROM of Apple's A12 and A13 chips. Because SecureROM is burned into the silicon at the factory, no software update can close the hole. Every affected device carries it for life.

The attack is not remote. It needs the device in your hand, DFU mode, a USB cable, and a custom RP2350 microcontroller board. With that kit assembled, the whole thing finishes in under two seconds, before Apple's signed boot chain ever gets a look in. The proof of concept went public on 18 June 2026 after coordinated disclosure with Apple.

The affected hardware

The list is long enough to matter:

• iPhone XS, XS Max, XR, 11, 11 Pro, 11 Pro Max, and the second-generation SE
• iPad Air 3, iPad mini 5, iPad 8
• Apple Watch Series 4, Series 5, and the first Apple Watch SE
• HomePod mini and various other A12/A13 products

A11 escapes because its USB driver resets the DMA address after every packet. A14 and later configure the chip's IOMMU correctly, which closes the door for good.

What actually goes wrong

The underlying bug lives in the Synopsys DWC2 USB controller. Odd-sized Setup packets cause the write pointer to step backwards through memory, 12 bytes at a time. On A12 and A13, Apple's SecureROM runs the USB DART (the chip's address translator) in bypass mode, so that drifting pointer can scribble straight into SRAM.

From there the researchers climbed to privileged execution. On the A13 they even defeated Pointer Authentication, the hardware feature meant to stop exactly this kind of code reuse attack, through a careful chain of heap corruption and timing tricks. The Secure Enclave sits behind a separate boundary and has not been broken, though Paradigm Shift notes that BootROM control may open fresh avenues for probing it.

How worried should you be

For most people, the day-to-day risk is genuinely small. An attacker needs the device in hand, the right cable, the right hardware, and the patience to force DFU mode. This is not something that ambushes you over coffee shop Wi-Fi.

For anyone running fleets in sensitive roles, the conversation is different. Custody, transport, and retirement of older hardware all become live questions. A misplaced iPhone XS in a high-trust role is no longer just a lost device, it is a device that can be coerced into running attacker code beneath the operating system.

A few practical things worth doing:

• Know which A12, A13, S4 and S5 devices in your environment are still doing serious work, especially anything holding credentials, certificates, or MDM trust.
• Plan refreshes toward A14 or newer where the role justifies it.
• Be careful about plugging older hardware into USB ports you do not control. Charge from the wall, not from a stranger's laptop.

checkm8 taught everyone that bootROM bugs do not age out gracefully. usbliter8 is the same lesson, one generation later, and the affected devices will keep showing up in pockets and drawers for years yet.