“The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim.”
NSO’s BLASTPASS took over fully patched iPhones with no click, through a PassKit attachment carrying a crafted WebP image. It ran inside Apple’s BlastDoor sandbox. Apple patched it in a day in 2023. The full public analysis took 18 months.