Security researchers at Google LLC have found a set of flaws in Apple Inc.’s iOS operating system that could enable hackers to compromise users’ devices remotely and steal their data.

The vulnerabilities, which number six in total, were detailed today by ZDNet. Google disclosed their existence to the publication following Apple’s release of an iOS patch last week that mitigated the flaws. However, the update fully neutralized only five of the six security holes, which led Google to hold off on publishing technical information about the sixth issue.

What the company did disclose is that all the bugs affect iMessage. They’re so-called interactionless vulnerabilities, meaning that hackers could use them to compromise an unpatched device without so much as requiring the victim to open an infected file or tap a malicious link.

Two of the flaws, codenamed CVE-2019-8624 and CVE-2019-8646, are memory exploits. They can be used to bypass iOS’s data access controls in order to access the user’s files remotely.

The four other flaws, which include the yet-unfixed CVE-2019-8641 vulnerability, present a different kind of threat. They make it possible for attackers to send malware to a device via iMessage and infect the target handset even if the user doesn’t the message. Though most of them have been resolved, the fact that one of the bugs is still exploitable represents a potentially serious concern for enterprise security teams.

According to ZDNet, the six vulnerabilities may be the first discovered in iOS that can be exploited without any user interaction. This could have made them a major threat had they been discovered by a malicious party and not Google.

Natalie Silvanovich and Samuel Groß, the researchers who found  the exploits, are part of the search giant’s Project Zero team. The group is tasked with finding zero-day, or yet-undiscovered, vulnerabilities lurking in popular software. Project Zero previously uncovered several other exploits in  Apple products, including a macOS exploit disclosed earlier this year that made it possible to install malicious code quietly on Macs. 

Photo: Unsplash