How Browser Exploits Work DarkSword, CVE-2025-43529, and the...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/how-browser-exploits-work-darksword-ios-cve-2025-43529
• Blog Title: How Browser Exploits Work: DarkSword, CVE-2025-43529, and the iOS Browser Exploit Chain
• Suggested Section: Binary Exploitation > iOS Exploiting > JavaScriptCore JIT, PAC Oracle, and WebContent-to-GPU Sandbox Escape Chains

🎯 Content Summary

Overview and impact

DarkSword is a one-click iOS watering-hole exploit kit disclosed on March 19, 2026 by Google Threat Intelligence Group, with parallel analysis from Lookout and iVerify. A victim only needs to tap a link to a compromised or look-alike website. The page silently loads an obfuscated JavaScript exploit chain that combines six vulnerabilities to move from attacker-controlled JavaScript in Safari to arbitrary kernel read/write within seconds. Three bugs were zero-days wh...

🔧 Technical Details

Optimizing-JIT speculation to arbitrary memory access: Target a JIT tier that optimizes hot JavaScript by assuming stable value types and removing repeated checks. Trigger a garbage-collection, object-state, or optimization transition that invalidates the assumption without activating the associated guard or deoptimization path. The resulting type confusion can make object-reference storage appear to contain doubles or make attacker-controlled doubles appear to contain references. Reading pointer bits through a double representation creates addrof; writing chosen pointer bits as a double and reinterpreting them as a reference creates fakeobj. Combining these primitives with controlled butterflies, typed arrays, or ArrayBuffer backing stores yields arbitrary read/write in the renderer. The construction must normally be retuned for each engine build because object layouts, structure IDs, and offsets change.

Legitima...

🤖 Agent Actions

Updated:

src/binary-exploitation/ios-exploiting/webkit-dfg-store-barrier-uaf-angle-oob.md

Added concise technical coverage of:

• Renderer-to-kernel process escalation chain
• Version-gated staged exploit delivery
• dyld-based PAC signing-oracle pattern
• JavaScript-only post-exploitation runtime
• WebContent-to-GPU graphics IPC attack surface
• Primary GTIG and 8kSec references with numbered citations

Validation passed: balanced Markdown fences, valid reference numbering, forbidden-source check, and git diff --check. Full mdBook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/how-browser-exploits-work-darksword-ios-cve-2025-43529

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > iOS Exploiting > JavaScriptCore JIT, PAC Oracle, and WebContent-to-GPU Sandbox Escape Chains".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0