There was a lot of recent, prominent news about a security vulnerability in WhatsApp that affects also iOS versions of the app. The volnerability has been described as carrying the risk of an attacker crashing the device (e.g. mentioned in the original report from Google Project Zero) or taking over control of a smart phone (e.g. mentioned by heise.de here in German; translation courtesy of Google Translate here). The suggested remedy is upgrading to at least version 2.18.93 of the iOS app; apparently no updates to iOS itself are required.
Since this is described as a bug in an app (not iOS itself) it makes me wonder: how can an app (legitimate or otherwise) crash or take over an iOS device in the first place? FWIK there are no SDK calls that would grant an app such powers and indeed the report mentions heap corruption. But how can heap corruption inside a single app cause such havoc to the entire system? I could imagine for this to be the case if the app's heap overlapped with memory owned by the operating system in a peculiar way such that (a faulty version of) the app could inject malicious code there. But in this case I would expect for this to be treated as a bug in iOS (not only the app), which is not the case here.
So what's going on here? How can a faulty version of an app (such as WhatsApp) crash an iOS device or allow for it to be taken over in its entirety?
UPDATE This article mentions the names of two Google engineers involved. Their twitter handles are
@taviso. Perhaps somebody with a Twitter account could reach out to them and draw attention to this question.