Researchers Uncover 6 Flaws in AirDrop and Quick Share Wireless Sharing

Security researchers Arash Ale Ebrahim and Nils Ole Tippenhauer from the CISPA Helmholtz Center for Information Security have uncovered six vulnerabilities in AirDrop and Quick Share, the wireless file-sharing features built into billions of Apple and Android devices. Published in a new research paper, the work represents the first side-by-side analysis of both stacks above the radio layer, examining how devices handle discovery, session handling, parsing, and trust decisions. An attacker positioned within wireless range, armed with nothing more than a laptop and no prior connection, can crash the sharing service on a Mac or iPhone set to receive from anyone—no tap, no prompt required (The Hacker News).

Three of the flaws target Apple's AirDrop implementation, and all three end in the same crash: they take down sharingd, the background macOS and iOS service that manages AirDrop, AirPlay, Handoff, Universal Clipboard, Continuity Camera, and NameDrop. A single malformed request sent to a device with AirDrop set to receive from "Everyone" is enough; looped roughly every two seconds, legitimate transfers are blocked indefinitely. Two of the bugs extend beyond AirDrop because they live in shared Apple frameworks. The most severe is a stack overflow in Foundation's XML property list parser, triggered by a file containing approximately 200 nested layers—affecting any Apple app that opens such a file across macOS, iOS, watchOS, tvOS, and visionOS. The AirDrop crashes were reproduced on macOS 15.7.4, macOS 26.3, iOS 18.x, and iOS 26.3.

The Quick Share research surfaced two Samsung-side flaws that let attackers bypass session checks entirely. One permits an unverified device to drive a connection before encryption is established; the other allows control messages to pass unencrypted even within supposedly secure sessions. A separate bug in Google's Quick Share Windows app lets attackers trigger a potentially exploitable crash. These wireless stacks skip standard authentication flows, so users can run a port scanner to confirm no unexpected services are exposed on local devices, and an SSL/TLS checker to verify that other local communications are properly encrypted end to end.

Patches are already rolling out. Apple has addressed one of the three AirDrop bugs and assigned a CVE, with the advisory not yet public; the remaining two remain in coordinated disclosure. Google paid a bug bounty for the Windows flaw and has landed a code fix, with its CVE still pending. Samsung's two bugs were handed to Google and remain under investigation. No public exploitation has been observed to date. Given how easily nearby attackers can reach these features, users should run a privacy checkup on devices that routinely accept wireless transfers, especially in high-density environments where an adversary can close the distance unnoticed.