Six security flaws in Apple’s AirDrop and Google/Samsung’s Quick Share have been found by researchers at the CISPA Helmholtz Center in Germany. An attacker with just a laptop and wireless range can crash the sharing service on a Mac or iPhone — no tap, no prompt, no prior connection needed.
The research by Arash Ale Ebrahim and Nils Ole Tippenhauer is the first to tear apart both file-sharing stacks side by side, above the radio layer. Their paper on arXiv details three bugs on each side.
The AirDrop flaws all crash sharingd, the background service that also handles AirPlay, Handoff, Universal Clipboard, and NameDrop. One crash takes down the whole set. The simplest attack needs one malformed request sent to a device with AirDrop set to “Everyone.” Hit it every two seconds and those features stay down as long as the attacker keeps going.
The nastiest AirDrop bug lives in Foundation’s XML parser — a stack overflow triggered by a tiny file with about 200 nested layers. Any Apple app opening an untrusted file of that type could hit it. That means macOS, iOS, watchOS, tvOS, and visionOS are all potentially exposed. The researchers confirmed crashes on macOS 15.7.4, macOS 26.3, iOS 18.x, and iOS 26.3.
On the Android side, two Samsung Quick Share flaws let an unverified device start driving a connection before encryption’s set up. Some control messages can pass unencrypted even after a secure session exists. An attacker on the same Wi-Fi could force a connection into an “accepted” state or feed fake IP and port values.
The most serious find is in Google’s Quick Share for Windows. It’s a use-after-free bug that surfaces when two connections collide at the right instant. Control Flow Guard is switched off in the app, which makes exploitation more plausible. The researchers confirmed a crash but didn’t build a working exploit.
Apple has patched one AirDrop bug — CVE assigned but advisory still embargoed. Google paid a bounty for the Windows flaw and landed a code fix, CVE pending. Samsung’s two bugs are under investigation. No public exploitation reports yet.
