No new iPhone? No secure iOS: Looking at an unfixed iOS vulnerability

Original Article ↗ Hacker News Discussion ↗

Apple is accused of quietly leaving known security vulnerabilities unpatched on older but still “supported” iOS versions, after a researcher showed a WebKit flaw on iOS 15 that can read local files is fixed only in iOS 17. Commenters debate whether this undermines Apple’s marketing around long-term security support, especially for devices like the iPhone 6s and 8 that still receive partial updates but miss some fixes. The conversation broadens into comparisons with Android’s update and custom ROM ecosystem, the lack of clear end‑of‑support policies, and concerns about e‑waste and the security of hand‑me‑down phones.

Nature and severity of the vulnerability

  • Exploit uses a WebKit/XML trick to read local files like /etc/passwd on iOS 15 (e.g., iPhone 6S), but not on at least some iOS 16 devices (one tester reports it fails on iPhone X).
  • Several commenters say exfiltration is trivial if the attacker controls the page: JavaScript can read DOM-injected file contents and send them to the same origin.
  • Others push back that the blog only demonstrated /etc/passwd, which is world-readable and identical across devices; they doubt access to more sensitive, sandboxed data like call history or app databases without proof.
  • The author confirms only testing /etc/passwd so far and no full validation of the more speculative “what could be stolen” list.

Apple’s patching strategy and ambiguity

  • Core complaint: Apple backports only a subset of security fixes to older iOS branches (e.g., 15.x, 16.x) while fully patching only the latest major version.
  • Many assumed “still getting security updates” meant “all known issues fixed”; discovering selective backports feels misleading.
  • Others argue vendors commonly triage backports based on severity, effort, and user share, and that this is normal industry practice.

Support windows, expectations, and communication

  • iPhone 6S (2015) still receives iOS 15 security updates (e.g., 15.8 in 2023), but is missing some WebKit/Chromium fixes present in iOS 17.
  • Some view 5–6 years of OS updates plus extra security patches as “above and beyond” most Android phones; others call it “pitifully short,” especially given hardware longevity.
  • Strong criticism that Apple does not clearly state when an iOS line is effectively EOL or what “supported” actually entails, unlike Windows’ explicit lifecycle dates.
  • Examples of interoperability breakage (e.g., newer Apple Watch or Apple TV features requiring iOS 17) reinforce the sense of de facto obsolescence before full security EOL is even clear.

Android, custom ROMs, and alternative OS paths

  • Pro-Android voices highlight the ability to install community ROMs (LineageOS, GrapheneOS, etc.) to get current patches on very old devices.
  • Counterpoints: custom ROM use is niche, often difficult, can break hardware features, and still relies on unpatched proprietary firmware blobs; not a practical solution for most users.
  • Contrast is drawn between Android’s decoupled browser/WebView updates via Play Store and iOS’s tight coupling of WebKit to the OS, which makes old iOS versions inherently stuck with old browser engines.

Security, ethics, and e‑waste

  • Some argue it’s unreasonable to expect decade-long full security backports; others say a company with Apple’s margins could do more and that short support cycles drive e‑waste.
  • Extra concern that insecure hand-me-down phones are often used by children and people who can’t easily upgrade.
  • Broad agreement that clearer, upfront commitments on support duration and patch scope would significantly improve the situation.