Security researchers have uncovered six previously undocumented vulnerabilities affecting Apple AirDrop and Google/Samsung Quick Share, following the first comprehensive reverse engineering and security analysis of the two proprietary proximity file-sharing protocols.

The vulnerabilities range from denial-of-service (DoS) issues to authentication and encryption bypasses, highlighting the significant attack surface exposed by wireless file-sharing technologies. According to the researchers, these widely used services have received surprisingly little academic security scrutiny despite their massive global deployment.

Figure 1. Wireless Attacks.

The research was conducted by Arash Ale Ebrahim and Nils Ole Tippenhauer from the CISPA Helmholtz Center for Information Security. To analyze Apple's proprietary implementation, the team reverse-engineered AirDrop, reconstructed its application-layer protocol stack, and developed AIRFUZZ, a protocol-aware fuzzing framework capable of testing complex serialized inputs before compression. They also manually analyzed Samsung's Quick Share implementation on Android and Google's Quick Share client for Windows. Figure 1 shows wireless attacks.

More Than Five Billion Devices Potentially Affected

Apple AirDrop and Google Quick Share power wireless file sharing on more than five billion devices worldwide. AirDrop is integrated into macOS, iOS, and iPadOS, while Quick Share is available across Android and Windows, with Samsung making it the default sharing platform on Galaxy smartphones. Since both services accept wireless discovery requests from nearby devices before authentication, they present a significant pre-authentication attack surface. During their research, the team reverse-engineered AirDrop's protocol stack, uncovering its proprietary DVZip compression format and more than 40 undocumented protocol commands.

Three Vulnerabilities in Apple AirDrop

Researchers identified three flaws affecting AirDrop. The first is a pre-authentication denial-of-service (DoS) vulnerability that can crash the privileged sharingd daemon, disrupting AirDrop along with Apple Continuity services such as AirPlay, Handoff, and Universal Clipboard. The second flaw is an XML property list parsing issue in Apple's Foundation framework, where deeply nested XML data can trigger stack exhaustion and application crashes across multiple Apple platforms. The third vulnerability affects Apple's HTTP/1.1 parser, allowing specially crafted requests to cause a NULL pointer dereference and another denial-of-service condition.

Three Quick Share Security Flaws

The researchers also discovered three vulnerabilities in Google's and Samsung's Quick Share ecosystem. On Samsung devices, certain protocol messages can be processed before the required UKEY2 authentication completes, enabling limited unauthenticated interaction. Another flaw allows some post-authentication messages to bypass SecureMessage encryption, creating an opportunity for on-path attackers to inject control messages. The third issue affects Google Quick Share for Windows, where a heap use-after-free bug could potentially be exploited for remote code execution.

Vendor Response

Apple acknowledged the reported AirDrop vulnerabilities and confirmed that security updates are being developed. Samsung forwarded its findings to Google after determining the affected code originated from Google's Nearby Connections framework [1]. Google rewarded the researchers for reporting the Windows vulnerability through its Vulnerability Reward Program, while the Android Quick Share issues remain under investigation.

Recommended Mitigations

The researchers recommend replacing network-triggered fatalError () calls with proper error handling, adding recursion limits to XML parsing, and strengthening HTTP request validation. For Quick Share, they advise enforcing authentication before processing protocol messages, applying encryption consistently across all message types, and redesigning endpoint management to eliminate race-condition vulnerabilities. They have also released AIRFUZZ, protocol documentation, and supporting research artifacts to help advance wireless protocol security research.

References

1. https://cyberinsider.com/apple-airdrop-and-android-quick-share-flaws-expose-users-to-wireless-attacks/

Cite this article:

Keerthana S (2026), AirDrop and Quick Share Vulnerabilities Put Millions at Risk, AnaTechMaz, pp.280.