- Published on
Vulnerability Research in AirDrop and Quick Share
- Authors
- Name
- DeepHorus
Security researchers have uncovered six critical vulnerabilities in the proximity file-transfer protocols Apple AirDrop and Android Quick Share, collectively used by over five billion devices. In a study titled 'Protocol Prying,' published on June 25, 2026, researchers from an undisclosed institution conducted the first cross-platform reverse engineering and protocol-aware fuzzing of these proprietary stacks. The findings expose pre-authentication flaws that could allow zero-click attacks, affecting macOS, iOS, Samsung, and Google Windows platforms.
Apple AirDrop and Google/Samsung Quick Share are designed to transfer files between nearby devices without prior pairing. Despite their massive user base, the application-layer security of these protocols remained largely unstudied because both stacks are closed-source and undocumented. The researchers reconstructed AirDrop's seven-layer state machine and DVZip adaptive compression from binary analysis, then built AIRFUZZ, a protocol-aware fuzzer that mutates pre-compression representations. They also performed targeted hand-written analyses of Samsung's Quick Share service and Google's Quick Share for Windows.
The investigation identified six distinct vulnerabilities (V1-V6). Three affect Apple's AirDrop: V1 is a Swift fatalError denial-of-service in the HTTP path router, V2 is unbounded XML plist recursion in Foundation, and V3 is a NULL pointer dereference in the HTTP/1.1 parser of this http URL library. Samsung Quick Share had two protocol-layer flaws: V4 allows pre-authentication OfflineFrame dispatch, and V5 enables encryption bypass for three frame types. Google Quick Share for Windows contained a heap use-after-free (V6), for which Google awarded a bounty.
These vulnerabilities are particularly concerning because both protocols are reachable from wireless proximity without any pairing, and they process complex serialized content inside privileged daemons. This makes them attractive targets for zero-click exploits that require no user interaction. The pre-authentication nature of most flaws means attackers could trigger crashes or potentially execute code even before a user accepts a file transfer.
All three vendors have acknowledged the findings after responsible disclosure. Apple, Google, and Samsung confirmed receipt of the reports, with Google issuing a bounty for V6. The researchers did not disclose whether patches have been deployed, but the acknowledgment suggests ongoing remediation efforts. Users are advised to keep their devices updated to the latest software versions.
The research highlights systemic security weaknesses in proximity transfer protocols, which are increasingly relied upon for quick file sharing. As these protocols evolve, the study underscores the need for more rigorous security testing on proprietary systems. The academic community may now apply similar protocol-aware fuzzing techniques to other wireless transfer services, potentially uncovering further vulnerabilities.
