Wireless file sharing has become one of the most frictionless things you can do with a phone or laptop. Hold two devices near each other, tap a few buttons, and a photo, document, or contact card moves between them in seconds without an internet connection, a cable, or even an account. Apple’s AirDrop and Android’s Quick Share (formerly Nearby Share) have made this so seamless that most people barely think about the mechanics.
That seamlessness is also where the security risk lives.
In mid-2026, security researchers published findings on six pre-authentication vulnerabilities across AirDrop, Samsung’s Quick Share implementation, and Google’s Quick Share for Windows. The vulnerabilities could allow a nearby attacker to crash your device, exfiltrate data, or in at least one case, potentially achieve remote code execution — without you accepting a file transfer, and in some cases without you knowing a connection was initiated at all.
How AirDrop and Quick Share Actually Work
Before getting into the vulnerabilities, it helps to understand what these tools do at a technical level.
Both AirDrop and Quick Share use Bluetooth Low Energy (BLE) to discover nearby devices and then establish a peer-to-peer Wi-Fi connection to transfer the actual file. The discovery process is automatic: as long as AirDrop or Quick Share is enabled, your device is broadcasting signals that other nearby devices can detect and respond to, without you explicitly initiating anything.
This is by design. The seamlessness comes from the fact that your device is always listening for compatible nearby devices. But it also means that your device is always talking to devices nearby — including devices you don’t recognize and haven’t chosen to interact with.
Both services have controls to limit who can initiate contact: AirDrop lets you set receiving to Everyone, Contacts Only, or off; Quick Share has similar visibility settings. But the vulnerabilities discovered in 2026 affect earlier parts of the connection process — the handshake that happens before any receiving setting would normally be consulted.
What the Researchers Found
The six vulnerabilities break down across three platforms:
Apple AirDrop
Researchers found three pre-authentication bugs in AirDrop’s protocol implementation. The most significant of these could allow a nearby attacker to crash an iPhone or Mac by sending a malformed packet during the connection establishment phase — no user interaction required, and no file transfer initiated. In the most severe scenario tested, the vulnerability could potentially be chained with other techniques to achieve code execution, though the researchers noted this was a more complex attack than a simple denial-of-service.
The pre-authentication nature is the key detail. Normal AirDrop’s privacy controls (Contacts Only, for example) kick in during the handshake — you’d be asked whether to accept a transfer. These vulnerabilities could be triggered before that stage, meaning the safeguard doesn’t apply.
Samsung Quick Share
Samsung’s implementation of Quick Share contained its own protocol bugs, separate from the underlying Android Quick Share architecture. Researchers found issues in Samsung’s custom extensions to the sharing protocol that could allow a nearby attacker to send unsolicited data or trigger unexpected device behavior.
Google Quick Share for Windows
The Quick Share for Windows desktop client had a vulnerability that researchers assessed as potentially leading to remote code execution — a higher severity than the crash-inducing bugs on mobile. The Windows client’s handling of certain types of connection requests contained a code path that could be exploited by a crafted message from a nearby device. This is the vulnerability that earned the most attention, given the potential severity of its impact.
The “Proximity Problem”
Researchers framing these vulnerabilities identified a shared root cause they called the “proximity problem”: both AirDrop and Quick Share are designed to make file sharing effortless by automatically detecting devices nearby, and that automation creates background services that communicate with any device in range before user approval is sought.
This is a design tension that no individual implementation can fully resolve without compromising the core product feature. The seamlessness of wireless device discovery is exactly what makes these tools useful. But it creates a background communication channel that operates outside the user’s active awareness — and any bugs in that channel can be exploited without any click, tap, or file acceptance on the user’s part.
The vulnerabilities discovered aren’t unique to Apple or Google’s carelessness. They’re natural candidates for research and discovery precisely because the underlying protocol involves devices talking to unknown nearby entities as a matter of course.
The Separate Issue: Cyberflashing and Unwanted Files
The pre-authentication vulnerabilities are the acute, technical risk. There’s a longer-running concern with AirDrop that doesn’t require any vulnerability at all: cyberflashing.
When AirDrop is set to receive from Everyone, anyone nearby can initiate a file transfer to your device. On Apple devices, this shows a preview of the incoming file before you accept it. Sending unsolicited, often explicit images to strangers in public spaces — trains, airports, crowded venues — became prevalent enough that several jurisdictions enacted laws against it specifically.
Apple responded in iOS 16 by making “Contacts Only” the default for AirDrop and adding a feature that, if you receive an unwanted image, automatically limits AirDrop to Contacts Only for the next 10 minutes. This reduced but didn’t eliminate the behavior.
The cyberflashing issue and the pre-authentication vulnerabilities are distinct: one requires no bugs, just deliberate misuse of a feature; the other is an exploitable flaw. But both stem from the same underlying design — a service that automatically opens a communication channel with nearby strangers.
Who Is Actually at Risk
The pre-authentication vulnerabilities discovered in 2026 require physical proximity. An attacker needs to be close enough for their device to establish a Bluetooth and Wi-Fi connection with yours — typically within 30 feet or so, sometimes less depending on conditions.
This makes the risk profile different from remote exploits, which can target any connected device anywhere. Proximity attacks require an attacker to be near you, which limits opportunistic mass exploitation.
The realistic threat scenarios:
Airports, transit hubs, and public venues. Dense, transient populations with many unknown devices. An attacker with a modified device targeting the Quick Share Windows vulnerability could position themselves in a busy airport and attempt to exploit any device in range running the vulnerable client.
Shared offices and coworking spaces. Physical proximity over longer periods, which gives more time for attempted connections.
Protests, political events, and activist contexts. Researchers note that proximity attacks are particularly relevant in contexts where someone might be specifically interested in targeting a known individual — a scenario that applies to journalists, activists, and people in situations where an adversary has reason to seek their specific device.
For most people in most situations, the probability of encountering someone actively exploiting these vulnerabilities is low. But “low” and “zero” are different, and for people in high-risk situations, proximity attacks are a known vector.
What Apple and Google Did (and When)
Apple released patches for the AirDrop vulnerabilities as part of iOS and macOS security updates. Google issued patches for Quick Share on Android. Samsung patched its implementation of Quick Share. Google’s Quick Share for Windows was updated via Google’s update mechanism.
If you keep your devices and software updated — the single highest-impact thing you can do for security — you are protected against the specific vulnerabilities published in 2026. Patch timing matters: devices running older software versions remain vulnerable until updated.
Practical Steps for AirDrop and Quick Share Users
For AirDrop
Check your receiving setting. Open Settings > General > AirDrop and confirm it’s set to “Contacts Only” or “Receiving Off.” The “Everyone for 10 Minutes” option from iOS 17 onward is safer than the old permanent “Everyone” but still opens a window of exposure.
Keep “Receiving Off” in unfamiliar public settings. Airports, event venues, and transit hubs are the environments where proximity attacks are most plausible. AirDrop is a two-button re-enable away when you need it.
Update iOS and macOS promptly. The vulnerabilities disclosed in 2026 have patches. Running updates promptly is the primary mitigation.
Disable AirDrop entirely when not in use. Control Center gives you a quick toggle. If you’re not actively expecting a file transfer, there’s no reason to leave the service in discovery mode.
For Quick Share
Limit visibility. Android’s Quick Share settings (similar to AirDrop) have options to share with Everyone, Contacts, or No One. Restrict to Contacts or No One when not actively sharing.
Update Quick Share for Windows. If you use Google’s Quick Share desktop app on a Windows machine, make sure it’s updated — this is the client where the highest-severity vulnerability was found.
Check Samsung device settings. Samsung’s Quick Share implementation is separate from base Android. If you’re on a Samsung device, look in settings under “Quick Share” for the appropriate visibility controls.
The Broader Pattern
These vulnerabilities are worth knowing about not because wireless file sharing is uniquely dangerous — it isn’t — but because they illustrate a pattern that appears repeatedly in convenience-first features: seamlessness requires background activity, background activity creates an attack surface, and that attack surface is outside the user’s direct control.
The same pattern appears in Bluetooth itself (a decades-long history of proximity vulnerabilities), in Wi-Fi auto-join behaviors, and in any feature that automatically initiates network activity on your behalf. The principle is consistent: every time a device communicates with an unknown other device without your explicit instruction, there’s a protocol that could have bugs, and bugs in proximity protocols are exploitable by nearby attackers.
For files that genuinely matter — documents, photos, sensitive records — it’s worth thinking about the transfer mechanism as carefully as the destination. A file transferred over a proximity channel with pre-authentication vulnerabilities is only as secure as the implementation of that channel. A file stored in a purpose-built personal storage app with encryption in transit and at rest never rides on that channel at all.
The features that feel most automatic are often the ones least examined. These vulnerabilities are a useful reminder that “automatic” is an implementation choice, not a guarantee, and what happens automatically on your device is worth understanding.