Apple has patched iOS against three zero-day vulnerabilities that attackers were actively exploiting in the wild. The attacks were discovered by Google’s Project Zero vulnerability research group, which over the past few weeks has detected four other zero-day exploits—three against Chrome and a third against Windows.

The security flaws affect iPhone 6s and later, seventh-generation iPod touches, iPad Air 2s and later, and iPad mini 4s and later. The flaws are:

• CVE-2020-27930, a code-execution vulnerability that attackers can trigger using maliciously crafted fonts
• CVE-2020-27950, which allows a malicious app to obtain the locations in kernel memory, and
• CVE-2020-27932, a bug that allows code to run with highly privileged system rights.