Zoom screen‑share bug lets attacker hijack iPhone or Mac

Zoom screen‑sharing flaw lets attackers seize devices

A single Zoom screen‑share let an attacker hijack any participant’s phone or Mac. Researchers demonstrated remote code execution by exploiting the way Zoom renders shared screens. The vulnerability worked on iOS and macOS clients, giving the attacker full control of the victim’s device. Zoom issued a fix within days of disclosure, replacing the vulnerable component in its client software.

The proof‑of‑concept required only a handful of commands fed to a public AI tool. The researchers reported that fewer than 20 prompts were enough to locate the flaw and generate a working exploit. The AI‑assisted approach cut the discovery cycle dramatically, highlighting how generative models can serve both offensive and defensive security work.

AI tools cut the discovery time

The AI model used was publicly accessible and designed for code assistance. By iteratively asking the model how Zoom handled screen‑share buffers, the team coaxed it into exposing a memory‑corruption path that led to arbitrary code execution. The model supplied exact function names and parameter values that matched Zoom’s open‑source libraries.

Because the AI answered with concrete code snippets, the researchers avoided the usual trial‑and‑error that can take weeks. The speed of the process raised concerns that similar tools could be weaponized by less‑skilled actors, turning a niche vulnerability into a mass‑scale threat vector.

Collaboration platforms under siege

Zoom is not the first collaboration product to suffer a device‑level exploit. Past incidents have shown that screen‑sharing, file‑transfer, and remote‑control features can be leveraged to run malicious payloads on Windows, Linux, and mobile clients. The common thread is the trust model: participants assume that a shared screen is benign, yet the rendering pipeline often executes native code.

Vendors have responded by sandboxing screen‑share processes and tightening API permissions. However, each mitigation adds latency or reduces feature richness, forcing product teams to balance security against user experience. The Zoom episode underscores that the balance point can shift quickly when an AI‑generated exploit surfaces.

Surveillance tech turns license plates into phone trackers

A separate development in the privacy arena links a vehicle’s license‑plate camera to nearby phones via Bluetooth signals. The technique captures a phone’s MAC address and correlates it with the vehicle’s location, effectively turning roadside cameras into personal trackers. Researchers note that the method could be deployed at scale with existing infrastructure.

Unlike the Zoom bug, which required user interaction, the surveillance approach works passively. It exploits the fact that most smartphones broadcast Bluetooth identifiers for pairing and location services. The ability to map those identifiers to a moving vehicle raises new questions about data retention policies and cross‑jurisdictional enforcement.

Legal pressure mounts on privacy promises

Apple’s iCloud Private Relay, marketed as an IP‑masking service, recently revealed a flaw that sometimes failed to hide users’ addresses from websites. Security researchers disclosed the issue last week, and a class‑action lawsuit has been filed alleging fraud. Plaintiffs argue that Apple’s assurances about anonymity were unsubstantiated.

The lawsuit arrives amid a broader wave of litigation targeting tech firms’ privacy claims. Courts are beginning to scrutinize the gap between advertised protections and real‑world performance. For Apple, the case could force a redesign of Private Relay or trigger regulatory penalties, adding to the cost of defending against security‑related lawsuits.

What to watch

Zoom’s patch will be rolled out to all clients over the next week; monitoring the adoption rate will indicate how quickly enterprises can remediate the exposure. Meanwhile, legislators in several states are drafting bills that would limit the use of Bluetooth‑based tracking by municipal cameras. Finally, the outcome of the Apple Private Relay class action will set a precedent for how aggressively courts will hold providers accountable for privacy‑feature failures. Stakeholders should track patch deployment metrics, legislative hearings, and court filings for the next quarter.