Apple's iOS 27.2 update closes a flaw that could have let a malicious app reach an iPhone's camera without the usual permission prompt, according to a security write-up from 9to5Mac.
The bug is tracked as CVE-2026-86990 and sits in CoreMedia, the system framework apps use to handle audio and video. Apple's own description is brief: it says an access issue was addressed with improved access restrictions. Security researcher Mustafa Calap is credited with the discovery. Apple has not said the flaw was exploited in the wild, and 9to5Mac's author notes that the problem is in software rather than hardware, and that the green camera indicator still lights up when the camera is in use, because the bug skips the permission check rather than the indicator.
The same fix ships beyond the new OS. According to 9to5Mac, it is also part of iOS 26.7.2 and macOS Tahoe 26.7.2 for people who are not moving to the new release, as well as iOS 18.7.11 for older devices such as the iPhone XS and iPhone XR. On the Mac, the permission prompt in question is handled by the TCC (Transparency, Consent, and Control) system.
The camera issue is one of more than 160 vulnerability patches that 9to5Mac says arrived with iOS 27.2. A separate flaw also landed in the older-device update: The Hacker News reports that Apple extended a fix for CVE-2026-86950, an out-of-bounds write in CoreGraphics rated 8.8 on the CVSS scale, to iOS 18.7.11 and iPadOS 18.7.11. Apple said it was aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific, targeted individuals. That fix was first released in September in the iOS 26.7.1 family of updates, and the outlet does not name any attacker.
For anyone with a supported device, the practical step is simply to install the latest update available for it. 9to5Mac also suggests reviewing which apps hold camera access under Settings, Privacy & Security, Camera on iPhone, or in System Settings on a Mac, and mentions Patrick Wardle's free OverSight tool, which alerts users when a camera or microphone turns on.
Apple's full list of security notes for each release is published on its security updates page. The company typically does not discuss technical details of vulnerabilities until patches are widely available.
0 comments