Google Project Zero Describes a Novel Way to Leak Memory Addresses Remotely on Apple Devices

Google's Project Zero research team has published details of an unusual technique that could reveal a memory address (a pointer) remotely, without relying on memory safety errors or timing attacks. Such leaks matter because they can help defeat ASLR, a protection that randomises where code and data sit in memory. The idea came from a 2024 team discussion about where an attacker might find a remote ASLR leak on Apple devices.

The technique only applies where a service takes data from an attacker, turns it into objects, converts those objects back into data, and sends that data back to the attacker. It relies on how pointer-keyed data structures behave. The team could not quickly identify a real macOS or iOS service that works this way, although they did not carry out extensive analysis to check. The researcher tested the idea on macOS using an artificial test case built around NSKeyedArchiver serialization.

Because no real-world impact was demonstrated, the issue was reported to Apple without being filed in Project Zero's bugtracker. Apple fixed it in its 31 March 2025 security releases. The author shared the work because the technique is novel and its ideas may apply in other contexts. It builds on earlier pointer leak findings by the same researcher. This summary is based on the opening of the article only.