Researchers Find Six Security Flaws in Apple AirDrop and Android Quick Share

Six flaws, five billion devices

Apple AirDrop and Android Quick Share exist so you can fling a photo or a file to a nearby device without digging through settings or pairing anything first. That convenience comes from the software constantly listening for other devices nearby, even when you are not actively using it.

Researchers at the CISPA Helmholtz Center for Information Security, a German cybersecurity research institute, examined how that listening process actually works under the hood. They found six vulnerabilities spread across Apple's, Samsung's, and Google's implementations of nearby-sharing technology.

The issues include crash bugs in AirDrop, protocol problems in Samsung's version of Quick Share, and a bug in Google Quick Share for Windows that the researchers say could potentially lead to remote code execution, meaning an attacker could run their own commands on an affected machine.

According to the research, three of the AirDrop issues could be triggered before the two devices even authenticate each other. This means a nearby attacker would not need you to accept a file transfer or approve anything on screen. The vulnerable window opens simply because the feature is on and listening.

How many phones are we talking about

The scale here is not small. Apple has reported more than 2.2 billion active devices running the sharing service tied to AirDrop. Google has reported more than 3 billion Android devices with Quick Share available system-wide or set as a default sharing option. Combined, the research says the affected protocols touch more than five billion devices worldwide.

That does not mean five billion phones are actively vulnerable right now. It means the underlying protocols researchers tested are the same ones running on that many devices, and patch status will vary by manufacturer, device age, and how current a person's software is.

The everyday risk, and its limits

The practical concern raised by Fox News' CyberGuy coverage, based on the CISPA findings, is straightforward. Your phone can be sitting in your pocket at an airport gate, in a crowded coffee shop, or inside a packed conference room, quietly listening for nearby sharing requests. If someone with bad intentions gets close enough with the right tools, they could try to exploit that open wireless channel before a phone's owner notices anything.

That is a fair description of what proximity-based wireless attacks require: physical closeness, specific technical know-how, and in most cases, the target's sharing feature actually being switched on and discoverable. It is not a remote attack that works from across the internet or across the country. A phone sitting at home with AirDrop or Quick Share turned off is not exposed to this particular set of bugs.

Security researchers regularly find flaws in widely used protocols, responsibly disclose them to the companies involved, and those companies patch the issues before the research becomes public or shortly after. Fox News' writeup does not report any confirmed real-world exploitation of these specific six vulnerabilities. This appears to be disclosed research, not an active attack campaign.

What you can actually do about it

The fix requires no technical expertise. On an iPhone, AirDrop can be set to "Receiving Off" or "Contacts Only" instead of "Everyone," which closes the always-on discoverability window when you are not actively sending or receiving a file. Android users can do the same with Quick Share, restricting visibility to contacts or turning it off entirely between uses.

The unresolved piece here is patch status. The research does not specify, based on available reporting, whether Apple, Samsung, and Google have already shipped fixes for all six flaws or whether some remain open. Anyone concerned should check for the latest iOS, Android, and Windows updates from their device manufacturer, since patches for wireless protocol bugs like these typically roll out through routine software updates rather than standalone security alerts.