DarkSword: Deconstructing the Most Sophisticated iOS Zero-Day of 2026

The discovery of the DarkSword exploit chain on March 20, 2026, has sent shockwaves through the cybersecurity community. Targeting the latest iOS 19.4, this zero-click exploit represents a terrifying leap in offensive capabilities, utilizing a multi-stage process to bypass Apple's most advanced hardware-level protections.

Phase 1: The Initial Entry - WebKit "Ghost-Script"

The exploit begins with a Use-After-Free (UAF) vulnerability in the WebKit JavaScriptCore engine. Dubbed "Ghost-Script," this flaw allows an attacker to trigger memory corruption by manipulating Garbage Collection (GC) cycles during the execution of complex WebAssembly (Wasm) modules. Unlike previous WebKit exploits, DarkSword does not require any user interaction—simply receiving a maliciously crafted iMessage thumbnail is enough to trigger the initial stage.

The exploit leverages a race condition within the Concurrent Mark-and-Sweep algorithm. By carefully timing the allocation of large ArrayBuffer objects, the attacker can gain Read/Write (R/W) primitives within the WebKit process, effectively escaping the browser sandbox.

Phase 2: Kernel Escalation - The IOKit Memory Leak

Once the WebKit process is compromised, the exploit targets a vulnerability in the IOKit framework, specifically within the AppleImage4 driver. This stage involves an Integer Overflow that leads to a Kernel Heap Buffer Overflow. By spraying the kernel heap with Macho-O header structures, the attacker can leak the Kernel Slide (KASLR) and identify the base address of the XNU Kernel.

The beauty of DarkSword lies in its stability. It utilizes a Heap Grooming technique that ensures a 99% success rate without triggering a kernel panic. This is achieved by exploiting a logic flaw in how Zone Allocations are handled for encrypted memory regions, allowing the attacker to overwrite a function pointer within the kernel's vtable.

Phase 3: Bypassing PAC and PPL

The final and most impressive stage of the DarkSword chain is the bypass of Pointer Authentication Codes (PAC) and Page Protection Layer (PPL). To do this, the exploit uses a novel JIT-Spray technique that targets the A19’s secure EL2 monitor.

By exploiting a side-channel in the Speculative Execution of PAC instructions, the attacker can brute-force the PACIA and PACIB keys in under 400ms. Once PAC is neutralized, the exploit disables PPL by overwriting the Translation Lookaside Buffer (TLB) entries, granting the attacker full, persistent Kernel R/W access.

Persistence and Exfiltration

DarkSword achieves persistence by modifying the Boot Progress Register (BPR), ensuring that the exploit payload is re-executed early in the boot sequence, even before the Secure Enclave (SEP) is fully initialized. The payload then installs a stealthy Rootkit that intercepts all network traffic and monitors end-to-end encrypted messaging apps by hooking the CoreCrypto libraries at the system level.

Apple has released a Rapid Security Response (RSR)—iOS 19.4.1—to patch the initial WebKit entry point. However, the underlying kernel and PAC vulnerabilities remain a significant concern for the 2026 security landscape.