iOS Research Tracker
FeedGitHub

iOS jailbreak & security research

Public developments, ranked by jailbreak relevance and linked to primary sources.

Last source pass
  • X / Twitter: Existing priority items reconfirmed
  • DiscordPartial: Discovery sample reviewed
  • GitHub: Six watched repositories unchanged

Priority watch

How stages work
Priority 1Calif / kernel research

Calif kernel exploit

Release announced

opa334 describes a path to A12/A13 Dopamine support. Newer devices still need an SPTM bypass.

Evidence record Announcement
Capability
Kernel read/write announced
Target
A12/A13 integration discussed; firmware ceiling pending
Watching for
Public source and an exact support matrix.
Priority 2

Calif persistence demo

Private demonstration

Tweak behavior returns after an update to 27.2. A fresh compromise of 27.2 is not established.

Capability
Persistence shown in video
Target
Reported iPhone 18 Pro; iOS 27.2 displayed
Watching for
Implementation details or independent reproduction.
Evidence record Video
Priority 3

Liter8

Public release

A released, tethered iPhone 11 research setup. v0.2.3 adds persistent Wi-Fi credentials and SFTP.

Capability
Patched boot; kernel access
Target
iPhone 11 only; builds through 27.2 (24B119)
Watching for
Expanded SEP, passcode, or cellular support.
Evidence record Release v0.2.3

All developments 8

1 held for evidence

Research developments reviewed November 3, 2026
DateDevelopmentStageCapabilityTargetSource
P1Calif kernel exploit

Exploit and write-up targeted within roughly a week.

 Release announced Kernel read/write announced A12/A13 integration discussed; firmware ceiling pending Announcement
P2Calif persistence demo

Tweak behavior returns after an update and reboot.

 Private demonstration Persistence shown in video Reported iPhone 18 Pro; iOS 27.2 displayed Video
P3Liter8

v0.2.3: Wi-Fi credentials persist; SFTP/SCP added.

 Public release Patched boot; kernel access iPhone 11 only; builds through 27.2 (24B119) Release v0.2.3
RawCamera · Canon sRAWCVE-2026-64750

Newly public report; the iOS 27 branch is already fixed.

 Public PoC Out-of-bounds buffer write macOS 26.6.2 (25G83) tested; fixed in iOS 27 Report + PoC
RawCamera · Phase OneCVE-2026-65395

Trigger/control pair isolates a missing row-width check.

 Public PoC 16-bit read-modify-write overflow macOS 26.6.2 (25G83) tested; fixed in iOS 27 Report + PoC
LinkPresentation · HEICCVE-2026-112621

Received-link preview reaches a mismatched image buffer.

 Public PoC Neighboring-buffer corruption macOS 26.7 (25G229) detailed; iPhone tests reported Source + report
AppleAVE2 · temporal layersCVE-2026-112705

Supplied panic supports a crash; useful kernel access remains open.

 Public crash PoC Kernel crash iPhone18,1; iOS 27.0.1 (24A446) Source + panic
CoreMedia · file descriptorsCVE-2026-112706

Daemon-opened descriptors expose a limited media-library domain.

 Public PoC Limited file read iOS 26.5 / 27.0 / 27.0.1 reported Source + logs

Ranked by priority, then publication date. Author-supplied results are attributed; independent execution is stated explicitly. Inclusion criteria