New usbliter8 SecureROM Exploit Enables iOS 27 Jailbreak on iPhone 11 Pro

A new developer-focused project, usbliter8-fun, showcases an iOS 27 jailbreak workflow specifically for the iPhone 11 Pro. It combines the usbliter8 SecureROM exploit with a custom firmware restoration process.

This proof of concept targets Apple’s A13-based iPhone 11 Pro. It is labeled as experimental, destructive, and unsuitable for use on primary devices.

New usbliter8 SecureROM Exploit

The project builds upon usbliter8, a tethered SecureROM exploit disclosed for Apple A12 and A13 hardware. SecureROM is immutable boot code embedded in a device’s silicon.

A successful exploit at this layer cannot be fully remedied through a standard iOS update. Researchers have identified the underlying issue as related to the Synopsys DesignWare USB controller and boot-chain configuration behavior.

This enables privileged code execution during DFU-mode interaction, particularly when an attacker has physical access to the device.

According to the repository documentation, the implementation currently supports only the iPhone 11 Pro running iOS 27 beta 2, specifically build 24A5370h.

This build identifier corresponds to Apple’s iOS 27 developer beta 2 release. The project emphasizes that offsets are build-specific and must be independently verified before adapting this work to other firmware versions or device models.

The exploit chain necessitates an RP2350-based device, such as a Raspberry Pi Pico 2, configured as a USB DFU exploitation tool.

Once the target device enters DFU mode and the exploit reaches the “PWN DFU” state, the project’s workflow generates and restores a modified IPSW. It then uses a custom ramdisk and SSH access to carry out subsequent modifications.

This requirement for physical access and tethering significantly limits the potential for remote abuse. However, it offers powerful capabilities for security researchers and jailbreak developers working with supported hardware.

The custom firmware patches outlined in the project aim to weaken several iOS security controls. They reportedly bypass USB Restricted Mode checks, relax sandbox restrictions for /var/jb, alter AMFI trust-cache behavior, enable ephemeral storage, and modify activation-related components.

The repository also mentions changes to key system services such as coreauthd, ctkd, mobileactivationd, and launchd configuration to prevent setup-stage failures caused by defective Secure Enclave Processor functionality and a Screen Time-related setup deadlock.

However, the project comes with strong warnings. Restoring the custom firmware may erase the device and render major functions nonfunctional, including passcode support, Wi-Fi, baseband services, parts of Bluetooth functionality, Apple services, and features dependent on the Secure Enclave Processor.

The repository also indicates that post-exploitation networking may require USB internet sharing, as wireless and cellular connectivity could be unavailable in the modified state.

For defenders, usbliter8 highlights the long-term security implications of hardware-rooted vulnerabilities. Although the requirement of physical access, DFU mode, specialized hardware, and a limited device scope reduces immediate enterprise risk, organizations with legacy A12/A13 Apple devices should treat unattended-device controls as essential.

Practical mitigations for SecureROM-class vulnerabilities include strong physical security, effective device inventory management, supervised-device policies, restricted USB access, and the rapid replacement of aging hardware.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.