Apple's iOS 27.2 Fixes CoreMedia Flaw Allowing Camera Access
Apple says CVE-2026-86990, found in the CoreMedia framework, was addressed with improved access restrictions and no indication of exploitation.
Apple released iOS 27.2 to the public this week with more than 160 vulnerability patches, including a fix for a CoreMedia bug that could let a malicious app access an iPhone's camera without the user's permission. According to 9to5mac.com, the flaw is tracked as CVE-2026-86990 and was credited to researcher Mustafa Calap.
In its security notes, Apple said the access issue was addressed with improved access restrictions. The company gave no indication that the flaw had been exploited in the wild.
The same fix ships in macOS Golden Gate 27.2, the release that accompanies iOS 27.2. Users on the previous generation of software are directed to iOS 26.7.2 and macOS Tahoe 26.7.2, which carry the patch as well.
Older iPhones, including the XS and XR, receive the fix in iOS 18.7.11.
Camera protections under scrutiny
The camera permission prompt on the Mac comes from a system called TCC (Transparency, Consent, and Control). Since 2008, Apple has placed the camera module and the green LED indicator on the same circuit in its devices, so the light comes on when the camera is active.
Quick answers
What is CVE-2026-86990?
It is a bug in Apple's CoreMedia framework that could let a malicious app access an iPhone's or Mac's camera without the user's permission. Apple says it was fixed with improved access restrictions.
Which software versions include the fix?
iOS 27.2 and macOS Golden Gate 27.2, iOS 26.7.2 and macOS Tahoe 26.7.2, and iOS 18.7.11 for older iPhones such as the XS and XR.
Was the flaw exploited?
Apple gave no indication that the vulnerability was exploited in the wild.