Apple pushed iOS 27.2 to the public this week with over 160 vulnerability fixes bundled inside. One of them, CVE-2026-86990, plugged a hole in CoreMedia that let a malicious app access the camera without ever asking permission. Researcher Mustafa Calap gets credit for the find. Apple's advisory is terse: “an access issue was addressed with improved access restrictions.” The bug lived in the permission layer, not the hardware.
On Mac, that layer is TCC — Transparency, Consent, and Control, the gatekeeper that puts up the prompt before an app can see through the camera. The exploit could skip the prompt entirely. The green indicator still works. On iPhone it's the green dot in the status bar.
On Mac it's the physical LED wired to the camera module. That circuit hasn't changed since 2008. But the light only helps if someone is watching. Phone face down on a desk.
Mac unattended. The feed goes live with no alert. No evidence of active exploitation, according to Apple. Still, the update is the only fix.
MacOS Golden Gate 27.2 carries the same patch. Devices staying on the previous major release get iOS 26.7.2 and macOS Tahoe 26.7.2. IPhone XS and XR owners land on iOS 18.7.11. Worth a minute after updating: open Settings > Privacy & Security > Camera on iPhone or System Settings > Privacy & Security > Camera on Mac.
Apps you don't recognize or no longer use may still have access. Revoke them. Tools like Patrick Wardle's OverSight, free, open source, log every camera and microphone activation on Mac and tell you which process triggered it. A piece of tape over the lens can't do that.
MDFiled by The Mobile Desk
Phones from leak to launch to price cut: what was announced, what it costs where, and when it goes on sale. Indian launches and prices included, not appended.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.