eSIM Bug in Millions of Phones Enables Spying, Takeover

A researcher found a Java Card VM "type confusion" vulnerability in Kigen eUICC eSIMs that allowed theft of private keys and over-the-air installation of malicious applets; Kigen published a patch for the affected eSIM OS variant, but because Java Card underpins many eSIM implementations, the flaw could expose large numbers of devices to spying, cloning, and interception of communications—an attractive capability for nation-state actors.