A total of 14 iPhone vulnerabilities including two zero-days when discovered have been targeted by five exploit chains in a watering hole attack that has lasted years. The watering holes deliver a spyware implant that can steal private data like iMessages, photos and GPS location in real time. There were seven bugs for the iPhone s web browser, five for the kernel and two separate sandbox escapes used in the attack. Google disclosed the issues to Apple in January, which resulted in the out-of-band release of iOS 12.1.4 in Feb 2019.
Source: https://threatpost.com/iphone-zero-days-watering-hole-attacks/147891/