iOS Research Tracker

iOS Research Tracker iOS jailbreak releases, demonstrations, and public vulnerability research, with evidence limits. https://jftechllc.com/ios-research-tracker/2026-11-03T12:00:00ZiOS Research Tracker Calif kernel exploit: Exploit and write-up targeted within roughly a week.https://jftechllc.com/ios-research-tracker/notes/calif-kernel-release/2026-11-03T12:00:00Z2026-11-03T12:00:00Z

Release announced · Kernel read/write announced · A12/A13 integration discussed; firmware ceiling pending. Anna Groza is aiming to publish an exploit and write-up. opa334 describes a path to broader Dopamine support on A12 and A13. The code and exact support matrix are still pending.

Calif persistence demo: Tweak behavior returns after an update and reboot.https://jftechllc.com/ios-research-tracker/notes/calif-lockdown-update/2026-11-03T12:00:00Z2026-11-03T12:00:00Z

Private demonstration · Persistence shown in video · Reported iPhone 18 Pro; iOS 27.2 displayed. Calif’s new video shows tweak behavior returning after an update and reboot, with iOS 27.2 displayed. Persistence and a fresh compromise of 27.2 remain separate claims.

Liter8: v0.2.3: Wi-Fi credentials persist; SFTP/SCP added.https://jftechllc.com/ios-research-tracker/notes/liter8-lab-updates/2026-11-02T12:00:00Z2026-11-03T12:00:00Z

Public release · Patched boot; kernel access · iPhone 11 only; builds through 27.2 (24B119). Version 0.2.3 adds persistent Wi-Fi credentials and SFTP. The preceding release added optional kernel-task access. The tethered boot and hardware limits still define the project.

RawCamera · Canon sRAW: Newly public report; the iOS 27 branch is already fixed.https://jftechllc.com/ios-research-tracker/notes/rawcamera-canon/2026-11-02T12:00:00Z2026-11-03T12:00:00Z

Public PoC · Out-of-bounds buffer write · macOS 26.6.2 (25G83) tested; fixed in iOS 27. Project Zero’s report connects a signed geometry-check failure to a negative row step, with a crafted image and debugger evidence. The iOS 27 branch is already fixed.

RawCamera · Phase One: Trigger/control pair isolates a missing row-width check.https://jftechllc.com/ios-research-tracker/notes/rawcamera-phase-one/2026-11-02T12:00:00Z2026-11-03T12:00:00Z

Public PoC · 16-bit read-modify-write overflow · macOS 26.6.2 (25G83) tested; fixed in iOS 27. A Phase One decoder trusts a file-supplied correction length. A one-tag control and measured fault make the new Project Zero disclosure particularly useful to study.

LinkPresentation · HEIC: Received-link preview reaches a mismatched image buffer.https://jftechllc.com/ios-research-tracker/notes/linkpresentation-heic/2026-10-30T12:00:00Z2026-11-03T12:00:00Z

Public PoC · Neighboring-buffer corruption · macOS 26.7 (25G229) detailed; iPhone tests reported. A detailed report connects received-link delivery to an out-of-bounds clear and draw. Neighboring-buffer writes add substance beyond the crash, with destination control still limited.

AppleAVE2 · temporal layers: Supplied panic supports a crash; useful kernel access remains open.https://jftechllc.com/ios-research-tracker/notes/ave-temporal-layers/2026-10-30T12:00:00Z2026-11-03T12:00:00Z

Public crash PoC · Kernel crash · iPhone18,1; iOS 27.0.1 (24A446). Concrete encoding calls and a supplied panic support a crash reproduction. Useful kernel access and mitigation bypasses remain unproven.

CoreMedia · file descriptors: Daemon-opened descriptors expose a limited media-library domain.https://jftechllc.com/ios-research-tracker/notes/coremedia-file-descriptors/2026-10-28T12:00:00Z2026-11-03T12:00:00Z

Public PoC · Limited file read · iOS 26.5 / 27.0 / 27.0.1 reported. The published app reads a daemon-opened descriptor while its direct open of the same path is denied. The demonstrated access is centered on the media library.