AirDrop attackers can crash Continuity apps—here’s the reality

AirDrop attackers – New research released June 30 shows attackers within 10 to 30 meters can trigger denial-of-service crashes against Apple AirDrop, temporarily disabling multiple Continuity features. The same study also found vulnerabilities in Google and Samsung Quick Share, w

For most people, AirDrop is the quiet magic of modern Apple life: you tap, someone appears, and a file moves. But a new set of findings released on June 30 paints a harsher picture of what happens when an attacker is close enough—and the target device is set to accept requests from strangers.

The CISPA Helmholtz Center for Information Security researchers say nearby attackers can crash Apple’s AirDrop before the user ever sees the transfer prompt. The disruption doesn’t stop at AirDrop. A crash can temporarily disable Apple’s other Continuity features, including AirPlay, Handoff, Universal Clipboard, and Continuity Camera.

The key detail is how the attack works and what it does. The researchers. Arash Ale Ebrahim and Nils Ole Tippenhauer. analyzed the network protocols behind AirDrop and Quick Share and identified three vulnerabilities affecting Apple’s AirDrop implementation. To carry them out. an attacker has to be within wireless range of a target device—typically between 10 and 30 meters—without prior pairing. an existing contact relationship. or a shared Wi‑Fi network.

On Apple devices configured to receive AirDrop from “Everyone. ” AirDrop begins handling some incoming network requests before displaying a transfer prompt. The disclosed vulnerabilities primarily disrupt service availability rather than exposing user data. The researchers did not identify a way to steal files. bypass Apple’s security protections. or execute arbitrary code on affected devices.

What the vulnerabilities do instead is repeatedly crash the background service that powers AirDrop and several other Continuity features until the service restarts.

The AirDrop weak spot sits in sharingd, a background service called sharingd. Apple uses sharingd to power AirDrop, AirPlay, Handoff, Universal Clipboard, and Continuity Camera. When sharingd crashes, those features can go down temporarily. In practice, the study describes an attacker triggering repeated failures by sending a malformed web request. One vulnerability causes sharingd to immediately shut down when it receives an unexpected web request. The researchers say an attacker can repeatedly trigger the crash by sending the malformed request every few seconds.

When that happens, repeated malformed requests kept sharingd unavailable for as long as the attack continued. Legitimate AirDrop connections couldn’t be established until the attack stopped.

A second Apple vulnerability affects Foundation, Apple’s core software framework. The researchers found that deeply nested XML property list files could cause part of Foundation to run out of stack space. They say the bug could affect apps on macOS, iOS, watchOS, tvOS, and visionOS that parse untrusted XML property lists.

The third vulnerability involves malformed request headers. It crashes Apple’s system HTTP parser and, like the others, functions as a denial-of-service crash.

Apple has moved on some of this already, at least partially. The company confirmed it fixed one reported AirDrop vulnerability and assigned it a CVE identifier. The security advisory and the specific CVE number haven’t been published yet. The remaining AirDrop vulnerabilities are still under ongoing disclosure.

Quick Share issues look different, but the same theme—making systems break at the wrong moment—shows up across ecosystems. The researchers say the Quick Share vulnerabilities came from protocol behaviors around authentication and encryption, not from parser crashes.

For Samsung, the team found protocol messages could be processed before authentication finished. Samsung’s implementation also continued accepting certain message types without encryption after the devices had already established an encrypted connection. Those flaws, the researchers say, allowed some protocol messages to bypass expected authentication or encryption checks. These Samsung-related issues remain under investigation, according to the researchers.

On the Google side. the findings include a memory management bug known as a use-after-free vulnerability in Google’s Quick Share client for Windows. The researchers tie it to a race condition between competing connections and say testing showed the flaw could reliably crash the application. They also note that the researchers didn’t develop an exploit capable of arbitrary code execution. Google later awarded a bug bounty for the finding.

Google has fixed the Windows Quick Share use-after-free vulnerability, but a public CVE assignment is still pending.

The researchers also point to a bigger architectural problem that isn’t tied to sharingd versus Quick Share clients. AirDrop and Quick Share share little underlying code, yet they present similar architectural challenges. Both platforms must process incoming network traffic before user interaction, giving attackers a larger window than many traditional network services.

Ale Ebrahim said the similarities didn’t come from shared implementations. According to the research, Apple’s vulnerabilities mostly involved software crashing after receiving unexpected data. Quick Share’s vulnerabilities centered on inconsistent enforcement of security-critical authentication checks and concurrency management. The researchers concluded that consistently enforcing security-critical validation at a single boundary can reduce vulnerabilities in complex network protocols.

Vendors may issue more security advisories as investigations finish.

For users trying to translate all this into daily safety. the researchers offer a clear constraint: the attacks require an attacker to be nearby and a device configured to accept AirDrop requests from people who aren’t already contacts. The report says most Apple users aren’t likely exposed to that combination during normal use.

If you don’t need to receive files from strangers, the safest move is straightforward. Users can reduce exposure by leaving AirDrop set to “Contacts Only,” or turning it off when it isn’t in use.

AirDrop Apple security sharingd Continuity AirPlay Handoff Universal Clipboard Quick Share CISPA Helmholtz Center CVE use-after-free denial of service