iOS 26.6: jailbreak false positive on non-jailbroken devices with TalsecRuntime 6.14.5

[yhhCh405]

Description

After devices are upgraded to iOS 26.6, freeRASP reports a jailbreak threat when the application opens, even though the devices are not jailbroken.

The jailbreak callback is triggered on every clean iOS 26.6 device tested so far. The same application/build did not report jailbreak before the OS upgrade.

Environment

• Flutter freeRASP version: 7.5.0
• Embedded TalsecRuntime version: 6.14.5
• Platform: iOS
• Affected OS: iOS 26.6
• Build type: Release/production-style build
• Device state: Non-jailbroken physical devices

The native framework metadata reports:

CFBundleShortVersionString: 6.14.5
DTSDKName: iphoneos18.5
DTXcode: 1640

Steps to reproduce

1. Install and launch a release build containing freeRASP 7.5.0 / TalsecRuntime 6.14.5 on a clean, non-jailbroken iPhone.
2. Confirm that jailbreak detection does not trigger before upgrading the device.
3. Upgrade the device to iOS 26.6.
4. Launch the same application.
5. Observe that the jailbreak callback is triggered immediately during application startup.

Actual behavior

The native iOS runtime emits .jailbreak, which is forwarded to the Flutter jailbreak callback. The application consequently treats the device as jailbroken.

This reproduces on 100% of the iOS 26.6 devices tested so far.

Expected behavior

A clean, non-jailbroken device running iOS 26.6 should not trigger the jailbreak callback.

Comparative result

We also tested a separate native iOS application on the same OS version. It embeds TalsecRuntime 6.1.2 directly and does not trigger its jailbreak handler on iOS 26.6.

That application does block when its Talsec runtime emits .jailbreak, so the absence of the restriction screen indicates that version 6.1.2 is not emitting the event. This suggests that a jailbreak heuristic added or modified between 6.1.2 and 6.14.5 may be incompatible with an environmental or behavioral change in iOS 26.6.

Additional context

• TalsecRuntime 6.14.0 introduced improved jailbreak detection methods.
• Later releases included fixes for jailbreak false positives on older iOS versions.
• The application receives only the aggregate .jailbreak event, so we cannot determine which internal jailbreak sub-check is failing.
• freeRASP 8.0.0 documents iOS SDK 6.14.4, so upgrading to 8.0.0 does not appear to provide a newer native detector than the currently embedded 6.14.5.

Could you please confirm:

1. Whether TalsecRuntime 6.14.5 officially supports iOS 26.6.
2. Whether this is a known false positive.
3. Whether a patched XCFramework or beta runtime is available for validation.
4. What diagnostic information we can provide to identify the failing jailbreak sub-check.

[alwinvazhappily]

Confirming this on a different runtime version, which widens the affected range.

• freeRASP: 7.5.1 (TalsecRuntime 6.14.4)
• OS: iOS 26.6 stable
• Device: iPhone 13
• Build: Release, installed from the App Store

The device has never had an iOS beta installed — it went from a prior stable release to 26.6 via a normal OTA update. The app was then downloaded fresh from the App Store, and onPrivilegedAccess fired on the very first launch. So this isn't limited to beta seeds, dev-signed builds, or upgraded installs.

[alwinvazhappily]

7.4.0 is working with iOS 26.6