Among the 160+ fixes in iOS 27.2 is CVE-2026-86990, a CoreMedia bug that could let a malicious app use your iPhone’s or Mac’s camera without your permission. 9to5Mac’s Security Bite dug into it.
What to know
- Researcher Mustafa Calap found it. Apple’s notes just say “an access issue was addressed with improved access restrictions.”
- It’s not a hardware issue. The camera and green LED still share a circuit, so the light should still come on.
- Apple gives no sign it was exploited.
- Fixed in iOS 27.2 and macOS Golden Gate 27.2, iOS 26.7.2 and macOS Tahoe 26.7.2, and iOS 18.7.11 for older phones like the XS and XR.
My take
Update and keep an eye out for that green dot. A camera cover won’t hurt, but the real protection is patching and not installing junk apps.
God Bless, and May the Source Be with You!
