daybreak RESEARCH
Source Live status
Status Log Targets Disclosure FAQ
Tracking live iOS 26.2 → 27.0 authorized research

iOS 26.2 bypass
research, in the open.

Independent vulnerability research targeting iOS 26.2 through iOS 27 to create working bypasses for the community. Every primitive is tracked here, live — the same way the progress page you're watching fills in.

View live status Read the research log
coverage
—
primitives
—
targets
8 devices
disclosure
coordinated

Status

surface* —
primitives —
syncing…
Attack-surface probes: —
Exploit-chain primitives: —

Coverage counts reflect lab observations against test devices owned by the researcher. Numbers update continuously from the tracking harness. No exploit code is published here as yet.

Research log

Newest first. Entries are added as work lands — the same cadence the tracker reflects.

  1. PPL bypass primitive reproduces intermittently on the 27.0 rig

    First variant of the page-mapping primitive lands on the iPhone 15 Pro rig, but only intermittently and it still panics on renegotiation. The tracker's PPL block stays mostly grey until the primitive is hardened and mapped cell by cell.

    PRIMITIVE

  2. Sandbox escape path documented for iOS 27.0

    Confirmed the escape survives the 27.0 sandbox profile rotation on two test devices. Most of its supporting primitives are still unmapped — the sandbox block sits just under a third.

    DISCLOSURE

  3. 26.2 regression runner deployed

    Harness now re-probes the full attack-surface grid nightly. Grey cells flip green only after three consecutive passes, which is why the surface panel fills slower than primitives.

    HARNESS

  4. WebKit renderer RCE confirmed on 26.2

    Renderer compromise achieved from a plain browsing context with no user interaction beyond page load. Escalation out of the sandbox is the current focus block in the chain panel to further exploit.

    MILESTONE

  5. Scope locked: iOS 26.2 → 27.0, iPhone 15/16/17 series

    Seed data loaded into the tracker. Blocks weighted by library size and expected primitive density, mirroring the treemap layout used on this page.

    SCOPE

Test matrix

Testing runs on devices I own, with the goal of a working bypass for the community.

DeviceBuildiOSSurface coverageChain status
iPhone 15A3090 · parity unit 23D10526.5
46.3%		 PPL verification
iPhone 15 ProA2848 · PPL test rig 23D10526.5
49.8%		 PPL verification
iPhone 15 Pro MaxA2849 · parity unit 23D10526.5
46.9%		 PPL verification
iPhone 16A3286 · secondary unit 23A34426.2
54.6%		 PAC pause
iPhone 16 ProA3101 · primary lab unit 23A34426.2
60.2%		 kernel r/w stable
iPhone 17A3512 · canary 24B10127.0
34.9%		 enumeration
iPhone 17 ProA3521 · canary 24B10127.0
39.7%		 enumeration
iPhone 17 Pro MaxA3522 · canary 24B10127.0
37.9%		 enumeration
GROUND RULES

Responsible by design.

This page publishes progress, and then completed payloads at the end of every thorough breakthrough.

  • No exploit code. The tracker counts primitives; it never ships them.
  • Owned devices only. Every test device in the matrix is owned by me.
  • Program scope. Work targets the official finished bypass.
CURRENT STATE
WebKit renderer RCE confirmed
Sandbox escape in progress
Kernel r/w in progress
PAC bypass early probes
PPL bypass early probes
Persistence not started
Payload / public release at breakthrough

Questions

Why publish a live tracker for security research?+

Progress trackers are a norm in this corner of research — they keep the work accountable and let other researchers follow along and join the mission.

Is any of this usable to modify my own device?+

Absolutely. The plan is a public, community release once the chain is complete — until then, this page only ships counts, not code.

What happens when the research succeeds?+

The bypass is built and shipped to the community.

Which iOS versions are in scope?+

iOS 26.2 through iOS 27.0 across the devices in the test matrix. Builds outside that range are only used to check whether a bug still reproduces.