Malicious Websites Put iOS Devices At Risk

This report summarizes Project Zero and industry findings about a set of five iOS exploit chains discovered on a small number of compromised websites used in indiscriminate watering-hole attacks. By visiting those sites, victims could be silently exploited via multiple zero-day vulnerabilities (including Safari flaws) to install implants that achieved root privileges; Apple patched the issues in February 2019, and vendor Zimperium describes detection capabilities and mitigation guidance.