Who can still jailbreak an iPhone in 2026

What a jailbreak is, and why people do it

People jailbreak phones to customize them, to run tools Apple does not allow, or to study the system. A jailbreak works by exploiting flaws in the phone’s software or hardware, which is why the same techniques sit close to the techniques of attackers.

Three terms matter. A tethered jailbreak needs a computer at every restart. A semi-untethered one lets the phone restart normally, and the owner re-runs an app to switch it back on. An untethered one survives a restart with no help. Dopamine’s release notes, for example, call that project semi-untethered[S1].

Our assessment: the 2026 map

Two public projects are active. The first, palera1n, lists support for phones with chips from the A8 to the A11, built on a hardware flaw known as checkm8 that dates from 2019 [S2][S3]. Its project page was showing beta releases of a new major version between July and October 2026[S2]. The project page does not list a ceiling for iOS versions, so we do not state one.

The second, Dopamine, released its 3.0 line from August 2026. Its release notes describe it as semi-untethered and list phones with A12 and A13 chips (the iPhone XS and XR era, and the iPhone 11) on iOS 26.0 to 26.0.1[S1].

We omit wider ranges that appear on a status guide, because they rest on that one page. That guide, last updated on 7 August 2026, lists no public jailbreak for A14 chips or newer on iOS 26, and none for any phone on iOS 27[S3]. It is a single source and is two and a half months old; we state it as "per the guide", not as settled fact.

The ceiling: why recent iPhones are out of reach

Apple’s own account explains part of the ceiling. In September 2025 Apple described Memory Integrity Enforcement, built into the A19 and A19 Pro chips. It combines hardened memory allocators, a hardware memory-tagging feature and protection for the secret tags[S4]. Apple says its offensive team rebuilt six real mercenary-spyware chains against it and found the protections cut each chain off early[S4]. Apple also says some bug classes survive and that older iPhones get only the allocator protections[S4]. These are Apple’s effectiveness statements, not independent measurements.

Older chips face a different problem: some of their flaws are in read-only boot code. In June 2026 a research group published a proof of concept, called usbliter8, for the boot code of A12 and A13 chips; press reports say a software update cannot fix it [S5][S6]. It needs physical possession, a wired connection and the phone in a recovery mode, and one record says its changes do not survive a restart [S5][S11]. The researchers show no compromise of the Secure Enclave[S5], although they warn that control at that level may open paths toward it[S6]. No CVE or Apple advisory existed at disclosure[S11]. For an examiner, the practical lesson concerns custody: where a phone has been, and who held it.

Apple adds that its memory protection covers the kernel and more than 70 user-level processes, and that app developers can opt in through Xcode’s security settings[S4]. A phone with that hardware is, on Apple’s account, a harder target for the memory-corruption techniques that most jailbreaks and exploit chains rely on.

Taken together, these facts shape who an examiner is likely to meet. In our reading, jailbroken iPhones that arrive for examination are most likely to run on chips up to the A13, because those are the chips for which public tools exist [S1][S2]. That is an inference from the project pages. No public source counts jailbroken phones, and we do not offer a figure.

The October demonstration in context

On 16 October 2026 the research firm Calif listed four demonstrations at the Hexacon conference in Paris, including a restart-persistent jailbreak, and said it will release them "in due time"[S7]. Calif’s own post names no device or software version[S7]. Decrypt reported that the phone was an iPhone 18 Pro on iOS 27.0.1, which restarted, unlocked with its ordinary passcode and offered a root shell again[S8]. Heise reports that Calif will not publish an end-user tool[S9]. Calif’s own pages say nothing about Apple’s memory protections, and Apple has published no advisory.

So, as of 21 October, there is no tool, no list of flaws and no way for an ordinary user to run this.

The risk the news creates

Enthusiast sites warn that any site, app or profile offering an "iOS 27.0.1 jailbreak" is false, because no tool is public, and expect survey walls, paid installers and configuration profiles to follow[S10]. In the sources we reviewed, no security firm has reported an actual campaign. We treat it as expected abuse, not an observed one.

What a jailbroken phone looks like to an examiner

Reporting based on research from Citizen Lab says a jailbroken iPhone may show package-manager apps[S12]. That is a clue, not proof of anything: owners jailbreak for lawful reasons, and a jailbreak is not an infection. What it changes is the baseline. An examiner can no longer assume that the files, settings and processes on the phone are the ones Apple shipped.

The deeper point is ours. A jailbroken phone’s system may not be as Apple shipped it, so evidence that describes the system’s state needs a caveat. A phone whose owner installed a profile or app from a fake "jailbreak" page raises a different question: what did that install change, and when?

What the Lab is watching

We are watching three things.

First, whether Calif releases flaw details, and whether an Apple advisory or CVE follows. Until one does, nothing about the demonstration can be checked, and Apple has not commented.

Second, whether security firms report fake jailbreak campaigns. The warning exists; a documented campaign does not.

Third, whether either project page adds support for A14 chips or newer. That would be the real change to this map. We will date any update and correct this article in the open if the picture moves.

What this means for examiners

Record the chip and the iOS version first, because they tell you whether a public jailbreak is even possible. Ask the owner whether they jailbroke the phone or installed anything from a "jailbreak" page. Do not download tools to test. Treat a claim that someone’s phone was "jailbroken remotely" as unproven until it is documented.

What we could not confirm

We could not confirm wider iOS ranges for either project than the release notes state, and the claim that no public tool exists for A14 chips or newer rests on a status guide updated on 7 August 2026. We also found no confirmation that any fake jailbreak campaign is under way, and we do not repeat reports of device models, codenames or memory-protection bypasses that rest on social media threads.

Glossary

Tethered: needs a computer at each restart. Semi-untethered: restarts alone, owner re-enables it. Untethered: survives restart unaided.