A BootROM vulnerability named usbliter8 has been disclosed against Apple’s A12 and A13 chips, the silicon inside the iPhone XS through iPhone 11 generation. Because the BootROM is written into the chip at the factory, no iOS update can repair it, so every device on those chips stays exposed for its remaining lifetime. Proof-of-concept code is now public alongside the research write-up.
Why a BootROM flaw is permanent
The BootROM, sometimes called SecureROM, is the very first code that runs when an iPhone powers on. It is hard-coded into the chip during manufacturing, so Apple cannot ship a patch through iOS the way it patches the operating system. Any flaw found there is effectively permanent hardware debt.
That is why this class of bug matters disproportionately. The last widely known BootROM exploit, checkm8, surfaced in 2019 and still applies to older hardware. usbliter8 continues the same lineage one chip generation forward.
Which iPhones are in scope?
The vulnerability covers devices powered by A12 and A13 chips, which is the iPhone XS through the iPhone 11 series. The A11 chip used in the iPhone X is not affected, and neither are A14-based devices and anything newer. Two design differences explain the gap:
- The A11 driver manually resets an internal pointer after each packet, which avoids the bug.
- A14 and later chips configure a memory protection feature at the BootROM level, which blocks the same path.
A12 and A13 fall between those two designs and inherit the vulnerable behavior.
What the researchers actually found
The exploit targets a bug in the USB controller that sits inside Apple’s silicon. During boot, when an iPhone receives USB traffic, the controller stores each incoming packet in a memory buffer. By sending a crafted sequence of unusually small packets, an attacker can manipulate an internal hardware pointer so it walks backwards through memory and writes data to locations it should not reach. The researchers describe this as a hardware controller bug rather than a software defect.
On A12 devices, reaching code execution through that path is relatively straightforward. On A13, Apple added Pointer Authentication Codes (PAC), a feature that detects and blocks certain types of memory tampering. Working around PAC required a longer, multi-step process before the A13 researchers could take control of the processor.
What an attacker can do with it
Once the exploit gains control, it installs a custom handler that survives a reboot. That handler can temporarily relax the device’s security settings and boot unsigned software without the usual verification checks. The proof of compromise is the same marker used by checkm8 and earlier exploits: the string “PWND” appears in the iPhone’s USB serial number.
For site owners and security teams running mixed fleets of corporate and personal Apple devices, this is a useful signal to add to any device inventory check. If a USB serial number on a managed iPhone suddenly starts with “PWND,” that device should be treated as compromised regardless of which OS version it runs.
Secure Enclave exposure
The researchers note that usbliter8 does not directly compromise the Secure Enclave. However, any BootROM-level takeover opens wider avenues for attacking the Enclave, because the chain of trust that normally protects it has been broken at the root. Coordinated disclosure was completed with Apple Product Security before publication.
How to audit for exposure
For a website audit, the practical angle is inventory and policy, not patching, since nothing patches this. A reasonable checklist:
- Identify every Apple device your team or user base owns that runs on A12 or A13 silicon. Those are the iPhone XS, XS Max, XR, 11, 11 Pro, 11 Pro Max, and the 2020 iPhone SE.
- For any device that must stay in service, enforce physical control over USB access and avoid unattended charging from unknown hosts.
- Treat devices showing “PWND” in their USB serial number as compromised and remove them from any workflow that touches credentials or sensitive data.
- Plan a hardware refresh path for affected units so the exposure has a defined end date.
FAQ
What is usbliter8 and which Apple chips does it target?
usbliter8 is a BootROM vulnerability with a public proof-of-concept exploit. It targets Apple’s A12 and A13 chips. Because the BootROM is burned into the chip during manufacturing, the flaw cannot be fixed with a software update.
Which iPhone models are affected by usbliter8?
Devices from the iPhone XS through the iPhone 11 series are affected, since those phones use A12 and A13 chips. The A11-based iPhone X and A14-based and newer devices are not affected.
Can usbliter8 compromise the iPhone Secure Enclave?
The researchers state that usbliter8 does not directly affect the Secure Enclave, but a BootROM-level compromise opens wider avenues for attacking it. Findings were reported to Apple Product Security before public disclosure.