Security researchers have identified a new set of vulnerabilities in Apple’s A and M-series Silicon chipsets, potentially exposing recent iPhones, iPads, and Macs to side-channel exploitation. According to a report, these vulnerabilities allow threat actors to access sensitive memory contents, including private data from applications like Google Maps and iCloud Calendar, which would typically be off-limits. Alarmingly, even the latest iPhone 16 models and M4-powered Macs are at risk, suggesting a widespread security concern for Apple’s ecosystem.
Apple Devices at Risk
A report by Ars Technica highlights that a wide range of Apple devices could be vulnerable to these exploits. Affected models include:
- All MacBook models from 2022 onward
- All iMac models from 2023 onward
- All iPad Pro, Air, and Mini models from September 2021 onward
- All iPhone models from September 2021 onward
This broad exposure means millions of Apple users could be at risk, especially those relying on these devices for sensitive tasks such as online banking, document storage, and location-based services.
How the Vulnerability Works
The vulnerability stems from an optimization technique in Apple’s Silicon chips known as speculative execution, which predicts and executes instructions ahead of time to improve processing speed. However, researchers have identified two types of side-channel attacks that exploit this mechanism. The more dangerous of the two, dubbed Floating-Point Operations (FLOP), manipulates the Load Value Predictor (LVP)—a component designed to predict memory contents—to trick the CPU into accessing restricted memory. This allows attackers to steal sensitive information from a user’s browser, such as Google Maps location history or events stored in iCloud Calendar. The attack is particularly effective if a victim has Gmail or iCloud open in one browser tab while visiting a malicious website in another for around five to ten minutes.
The Security Implications
Security experts warn that this exploit could bypass critical memory safety checks, making unauthorized data access easier. “If the LVP guesses wrong, the CPU can perform arbitrary computations on incorrect data under speculative execution. This can cause critical checks in program logic for memory safety to be bypassed, opening attack surfaces for leaking secrets stored in memory,” the researchers stated. Given the severity of the issue, Apple is expected to address these vulnerabilities in upcoming software updates or possibly future hardware revisions. Until then, users should be cautious about their browsing habits and avoid keeping sensitive applications open while navigating untrusted websites.