FORCEDENTRY: why a phone can process a threat before you tap.
Apple’s patch and Google Project Zero’s research explain the difference between clicking a link and automatically parsing content.
What happened?
Historical case. Apple fix: 13 September 2021. Source checked: 22 October 2026.
FORCEDENTRY was an iMessage zero-click exploit analyzed by Google Project Zero after Citizen Lab shared a captured sample. A zero-click attack can exploit content processing without requiring the recipient to open a link.
What caused the vulnerability?
The research describes a complex exploit involving automatic document/image processing. Apple identified an integer overflow in CoreGraphics, addressed with improved input validation, as CVE-2021-30860.
How was it identified?
Citizen Lab captured an in-the-wild sample and shared it for analysis. Google Project Zero and Apple collaborated on the technical investigation. These findings came from evidence, not from assuming every unexpected message was malware.
Google Project Zero’s analysis.
What was fixed?
Apple’s iOS/iPadOS 14.8 security notice lists the CoreGraphics fix. That is the historical fix for this CVE, not a recommendation to install an old operating system today. Use the current supported update for your device.
Make the mechanism understandable
Build a toy parser for harmless structured text. Demonstrate a strict size/type check accepting a valid example and rejecting an invalid one before further processing.
Show the difference between “received,” “parsed” and “opened by the user.” Do not distribute a weaponized attachment. The toy exercise teaches input validation; it does not recreate the iMessage exploit or prove a phone is malware-free.