iOS 27.2 Update Fixes Critical Unauthorized Camera Access Flaw

Apple has officially released iOS 27.2, which includes extensive security updates. The patch resolves more than 160 vulnerabilities, including a critical flaw that allowed malicious applications to activate the camera without user consent. ## What was the problem? The vulnerability, identified as CVE-2026-86990, was located within CoreMedia, a software framework used by applications to process audio and video content. Discovered by researcher Mustafa Kalap, the flaw enabled applications to bypass Apple’s Transparency, Consent, and Control (TCC) security system. Typically, TCC requires users to manually approve camera access, but this vulnerability allowed apps to circumvent that requirement entirely. It is important to note that this is not a hardware issue. Apple’s camera module is designed so that the green indicator light is physically tied to the camera’s operation. Therefore, even when an app deceived the system, the green dot would still illuminate upon activation. However, the indicator only serves as a warning if the user is within the visual range of the device. ## Why is this update important? While there is no evidence that this vulnerability has been exploited in the wild, security experts strongly recommend installing iOS 27.2 or the corresponding version for macOS immediately. For users with older devices such as the iPhone XS or XR, the update is available as iOS 18.7.11. Apple has strengthened access restrictions, making it impossible to trigger the camera illegally through CoreMedia. ## How to protect yourself? In addition to regular system updates, it is good practice to periodically review which applications have permission to access your camera. On an iPhone, you can do this via Settings > Privacy & Security > Camera, and on a Mac via System Settings > Privacy & Security > Camera. Review the list and remove any applications you no longer use or trust. For added security, open-source tools like OverSight are available, which notify users whenever a process activates the camera or microphone. This allows you to monitor application activity in real-time and prevent unwanted surveillance.