Researchers have identified two security vulnerabilities affecting all modern iPhones, iPads, and Macs, as well as many older models. These vulnerabilities, referred to as SLAP and FLOP, have the potential to enable an attacker to view the open web tabs currently in use on your device.
These flaws originated from the A15 and M2 chipsets and are also present in later versions, encompassing the most current iterations of Apple devices.
What are SLAP and FLOP?
SLAP (Speculation Attacks via Load Address Prediction) and FLOP (False Load Output Predictions) were uncovered by security experts at the Georgia Institute of Technology. Their operating principles are similar to those of the Spectre and Meltdown vulnerabilities.
These issues arise from a methodology employed by Apple and other chip manufacturers aimed at enhancing processing speed. Known as speculative execution, this strategy allows chips to predict likely future commands and pre-load the necessary data for those commands.
If an attacker manages to inject malformed data into these processes, they can access memory content that should remain secure.
What are the vulnerabilities?
In Safari, each tab is designed to be sandboxed, meaning a website open in one tab cannot access data from another website open in a different tab.
Through SLAP, if a user is tricked into visiting a compromised website, the attacker can then harvest data from any other Safari tab open on the device. This might include reading emails, accessing location data in Apple Maps, or even viewing banking information.
FLOP operates similarly but is more robust, as it works in both Safari and Chrome.
No malware is necessary for these attacks on your Mac; rather, they exploit weaknesses in Apple’s own code, making it extremely difficult to detect if an attack is occurring.
Which devices are vulnerable?
Any Apple device featuring an A15 chip or later, as well as those equipped with an M2 chip or later, are at risk. The researchers confirmed that these devices are susceptible:
iPhone:
- iPhone 13
- iPhone 14
- iPhone 15
- iPhone 16
- 3rd-gen iPhone SE
iPad:
- iPad Air models from 2021 onwards
- iPad Pro models from 2021 onwards
- iPad mini models from 2021 onwards
Mac:
- MacBook Air models from 2022 onwards
- MacBook Pro models from 2022 onwards
- Mac mini models from 2023 onwards
- Mac Studio models from 2023 onwards
- iMac models from 2023 onwards
- Mac Pro (2023)
What’s the real-world risk?
Research indicates that there is currently no evidence suggesting that either vulnerability has been exploited in real-world scenarios.
Apple has been actively working to address both vulnerabilities since they were first reported: SLAP was notified in May 2024, while FLOP was reported in September 2024.
The company provided a concise statement to Bleeping Computer:
Based on our analysis, we do not believe this issue poses an immediate risk to our users.
At this time, there are no specific precautions users can take other than maintaining vigilance regarding the websites they visit.
Image: DMN collage using photo from Apple
: . More.
