# AirDrop and Quick Share Flaws Expose iPhones and Macs to Remote Crashes and Access Bypasses


Two researchers have discovered six critical vulnerabilities in Apple's AirDrop and Google's Quick Share—proximity-based file-sharing protocols trusted by millions—that allow nearby attackers to crash the services and potentially bypass security checks with nothing more than a laptop and wireless range. The flaws affect both macOS and iOS devices configured to receive files from anyone, and require no user interaction, tapping, or prior authentication to exploit.


## The Threat


The vulnerabilities present a multi-layered attack surface on devices that users assume are safe because they operate over short distances. Researchers discovered that an attacker within wireless range can:


  • Trigger denial-of-service crashes on macOS and iOS by sending malformed packets to AirDrop's peer discovery service
  • Bypass security prompts that normally require users to approve file transfers
  • Initiate connections to devices without any notification or consent mechanism
  • Manipulate protocol handshakes to confuse or disable the sharing feature entirely

    • The attack requires only a standard laptop running specialized tools—no sophisticated exploit kit, no zero-day payload, no need to be on the same network. Any device advertising itself as willing to receive AirDrop or Quick Share files becomes an immediate target.


    ## Background and Context


    AirDrop (launched in 2011) and Quick Share (Google's 2021 answer to Apple's dominance in proximity sharing) were designed to make seamless, secure file transfer between nearby devices as frictionless as possible. Both services use a blend of Bluetooth for discovery and Wi-Fi Direct for the actual data transfer, with cryptographic checks to prevent eavesdropping.


    The appeal is obvious: drop a file, confirm with a tap, done—no email, no cloud sync, no messy cloud storage links. For medical staff sharing patient images, creative teams swapping design files, or families sharing photos, AirDrop became the de facto standard.


    That convenience, however, came with an implicit trust assumption: *that the device initiating the transfer is who it claims to be*, and *that the protocol itself is robust enough to handle unexpected input*. The newly discovered flaws suggest both assumptions need revision.


    ### Affected Devices and Versions

  • Apple: iPhones, iPads, and Macs running current and recent versions of iOS, iPadOS, and macOS
  • Google: Android devices running recent versions of Android with Quick Share enabled
  • Severity: Crashes affect availability; the security-check bypasses affect integrity and user trust

    • ## Technical Details


    The researchers identified six distinct vulnerabilities across the two platforms:


    | Vulnerability | Platform | Impact | CVSS Estimate |

    |---|---|---|---|

    | Malformed Bluetooth packet crash | macOS/iOS | Denial of Service | 7.5 (High) |

    | Out-of-bounds memory read in peer discovery | macOS | Information Disclosure | 6.2 (Medium) |

    | Protocol handshake confusion leading to bypass | iOS | Bypass of user consent | 8.1 (High) |

    | TLS session reuse in Quick Share | Android | Man-in-the-Middle potential | 7.8 (High) |

    | Weak certificate validation on resume | macOS | Impersonation | 7.0 (High) |

    | Race condition in file acceptance queue | iOS/Android | Unauthorized file receipt | 6.8 (Medium) |


    The most critical flaws exploit race conditions in how the devices queue and validate incoming file requests. By sending overlapping packets designed to confuse the state machine that governs the handshake, an attacker can trigger a state where the device believes a user has already approved a transfer—when they haven't.


    On macOS, the researchers demonstrated the ability to crash the Finder's AirDrop handler by sending specially crafted Bluetooth LE (Low Energy) advertisement packets. The crash requires only microsecond timing precision and a single packet—no sustained attack, no large bandwidth requirement.


    ## Implications for Users and Organizations


    ### Individual Risk

  • Always-on AirDrop: Users who leave their devices set to "Receive from Anyone" (as opposed to "Receive from Contacts Only") are immediately exposed in public spaces—airports, cafes, conferences, hospitals, offices
  • Silent crashes: A device crash during a critical workflow can disrupt medical procedures, financial transactions, or emergency communications
  • Phishing vector: An attacker who can bypass the user-approval prompt gains a new channel to inject malicious files into a target device's file system

    • ### Enterprise and Healthcare Risk

    Healthcare organizations are particularly exposed:

  • Clinicians using iPads or iPhones to share medical imaging or patient records via AirDrop (a common workflow to bypass email compliance overhead) may unknowingly enable attackers to intercept, corrupt, or inject false data
  • Hospital networks dense with Apple devices amplify the attack surface; a single bad actor in a waiting room or parking lot can disrupt multiple clinical workflows
  • The race-condition exploits are difficult to detect and log, meaning breach investigations may find no record of the file transfer

    • ### Developer and System Administrator Risk

  • Open-source projects and development teams that rely on AirDrop for secure local collaboration may be exposing source code or credentials
  • IT teams managing BYOD programs have limited visibility into whether the vulnerability has been actively exploited

    • ## Recommendations


    ### For Users

    1. Change AirDrop settings to "Contacts Only" (macOS and iOS)

    - This eliminates the attack surface by requiring devices to authenticate against your contact list

    - The slight inconvenience is worth the security gain


    2. Disable AirDrop when not actively using it

    - In Control Center (iOS) or System Settings (macOS), turn off the feature

    - Re-enable only when you're about to transfer a file


    3. Avoid public spaces while leaving AirDrop active

    - If you must use AirDrop in a coffee shop or airport, use "Contacts Only" mode


    4. Monitor for unexpected crashes or file receipts

    - If your device suddenly crashes, check Recent Files for unexpected additions


    ### For Organizations

    1. Deploy Mobile Device Management (MDM) policies that enforce:

    - AirDrop disabled by default

    - Quick Share disabled for sensitive device classes (clinical iPads, financial terminals)

    - Automatic enablement of "Contacts Only" or equivalent restrictions


    2. Conduct risk assessments in high-density Apple device environments (hospitals, law firms, media companies)

    - Identify workflows that depend on AirDrop

    - Evaluate alternatives: secure file transfer servers, encrypted messaging platforms, or VPN-based solutions


    3. Patch aggressively once Apple and Google release fixes

    - These are pre-authentication vulnerabilities; patch deployment should be prioritized


    4. Audit logs and network monitoring

    - Enable any available logging for AirDrop/Quick Share activity

    - Monitor for unusual Bluetooth LE traffic in sensitive areas


    ### For Apple and Google

  • Both companies have been notified and are developing patches
  • Expected timeline: patches in the next major OS updates (iOS 18, macOS 15, Android 15)
  • Until then, the onus falls on users to manually restrict their settings

    • ---


    ## HackWire Analysis


    This vulnerability cluster exposes a fundamental design tension in consumer security: the friction between convenience and safety. AirDrop succeeded precisely because it eliminated prompts and confirmations that users found annoying. The new flaws show that this design choice—keeping the user experience frictionless—came at a real cost.


    What's particularly concerning is that this isn't an exotic zero-day that requires a nation-state. These are logic flaws in protocol handling that two researchers found with standard tools. That suggests Apple and Google may not have stress-tested their proximity protocols against adversarial input as rigorously as their cloud services or app ecosystems. Proximity was treated as a trust boundary, when it should be treated as an attack surface like any other.


    The pattern here mirrors earlier vulnerabilities in Bluetooth, Wi-Fi Direct, and NFC: when a protocol prioritizes speed and ease of use, security review often lags. For healthcare, finance, and other high-stakes domains, the lesson is clear—proximity is not authentication. Relying on AirDrop or Quick Share for sensitive data transfer is riskier than the frictionless UX suggests.


    The most practical hidden risk: organizations deploying clinical tablets or financial devices assume "it's local, so it's safe." These flaws shatter that assumption. A determined attacker in a hospital or bank office can now disrupt or manipulate devices without ever gaining network access. That's a new class of threat that most enterprise security teams haven't modeled yet.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Malware](https://www.hackwire.news/category/malware) and [Privacy](https://www.hackwire.news/category/privacy)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)