This is worth a read if you haven't seen it: pt 1: https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleproj

This is worth a read if you haven't seen it: pt 1: https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl... pt 2: https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl... TLDR: Google research exploits wifi firmware of broadcom chip in iphone, then uses that to exploit a driver bug, and manages to root the iphone. All without even connecting it to a specific AP, just from broadcast packets.