A malicious app could have reached an iPhone’s camera without the permission prompt ever appearing, until Apple shipped a fix on October 26, 2026. The correction sits inside iOS 27.2, a release that carries more than 160 vulnerability patches. Apple has not indicated that the camera bug was exploited in the wild.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The flaw is tracked as CVE-2026-86990 and lives in CoreMedia, the framework apps use to handle audio and video. Apple’s advisory describes the impact as a malicious app being able to access the camera without user permission, and the repair as an access issue addressed with improved access restrictions.
CVE-2026-86990 and the CoreMedia permission check
Apple’s security notes for iOS 27.2 and iPadOS 27.2 credit the discovery to Mustafa Calap, who publishes as @ordinal0 at dbg.re. The CoreMedia section of the advisory lists four CVEs: CVE-2026-86992, CVE-2026-112706, CVE-2026-112688 and CVE-2026-86990. Only the last concerns the camera, and Apple’s one-line description gives no detail on how a rogue app could skip the prompt.
Arin Waichulis of 9to5Mac, writing in the outlet’s Security Bite column, stressed that this is a software flaw and not a hardware one. The camera module and the indicator light were not at fault. Because the bug targets the permission rather than the indicator, the green dot on an iPhone would still appear while the camera ran.
The indicator detail matters for the realistic risk. As 9to5Mac’s report on the camera bug puts it, the indicator only helps if someone is looking at the screen. A phone lying face down on a table or left away from the desk could, in theory, hand an app a live feed of the surroundings with nobody watching the dot. Waichulis concluded the bug does not change his view that physical camera covers are largely useless, though it does show that the permission prompt itself could be bypassed.
The wording is typical of Apple’s advisories, which keep exploit mechanics out of public view until most owners have updated. Apple lists the impact, the component and the researcher, and leaves the rest to the people who study the patch. The one limit the advisory states on the risk is the delivery path: the impact line speaks of a malicious app, so an attacker would first have to get something onto the device, the same barrier that protects against most app-based threats.
Patched builds for older iPhones and Macs
The fix is not limited to the newest phones. iOS 27.2 supports the iPhone 11 and later, and Apple’s list of releases on its security updates page shows the 27.2 line dated October 26, 2026. For people who have not moved to the new operating system, 9to5Mac says the same camera fix arrived in iOS 26.7.2 and macOS Tahoe 26.7.2. Mac owners on the new release get it in macOS Golden Gate 27.2.
Older iPhones such as the XS and XR, which cannot run iOS 27, receive iOS 18.7.11.
The camera issue also reaches the Mac, where permission requests are handled by the Transparency, Consent, and Control framework, known as TCC. On a Mac the equivalent of the iPhone’s green dot is the LED beside the camera lens, and the same reasoning applies: the light stays on, but the consent step may have been skipped.
Apple’s advisory for the release spans a long list of components beyond CoreMedia, which is why 9to5Mac frames the camera item as one entry in a large security release and not the lone reason to update. Phones that are several point releases behind collect every fix in between, so the practical gap for a device still on an earlier build is the whole stack of patches, with the camera bypass as the item most easily explained to a non-specialist.
Camera covers, permissions and OverSight
Waichulis points to three habits that cover the gap until an update lands. The first is installing the patched build. The second is reviewing which apps hold camera access, through Settings, then Privacy & Security, then Camera on an iPhone, or the matching pane in System Settings on a Mac, and removing access from apps that are unused or unfamiliar. The third is running a monitor such as OverSight, a free, open-source macOS tool from Objective-See that alerts the owner whenever the camera or microphone switches on and tries to identify the process responsible.
OverSight requires macOS 12 or later and an administrator account, so it is a Mac answer to a problem the iPhone solves only through the update itself.
Installing the update tonight
Apple’s instructions for updating an iPhone are short: back the phone up, connect it to power and Wi-Fi, open Settings, then General, then Software Update, and choose Download and Install if an update is listed. Automatic Updates, in the same menu, can be set to install overnight while the phone is charging and on Wi-Fi.
The open question is scale. Apple’s notes show 160-plus fixes but publish no exploitation data for any of them, so the only claim the public record supports for the camera bug is Apple’s own wording and the absence of any statement that attackers used it.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
