Apple’s HomeView goes on sale Friday, Nov. 13, and its first security update was already out on Nov. 12. HomeView Software 27.2 fixes nine CVEs, among them a flaw that let a remote attacker join an iMessage group chat and receive its messages. Anyone unboxing the device on launch day should expect to install the update first.
Read next on Morning Overview: Winter weather advisories cover I-80, I-70 and the Bighorns with up to 15 inches of snow
Nine fixes in a release dated the day before sale is a lot for a new product, though none of the entries in Apple’s document describes active attacks. The flaws sit mostly in the plumbing that pairs the device with phones and speakers and in the messaging stack it shares with the iPhone.
Nine CVEs across seven components
Apple’s security notes for HomeView Software Version 27.2, published Nov. 12, 2026, list nine entries, each marked as available for Apple HomeView. The affected components are AirPlay, App Intents, Bluetooth, brotli, CoreUtils (two entries), Messages (two entries) and rapportd. The document gives impact and fix descriptions but Apple lists the update for HomeView only, and the dated page is Apple’s authoritative list for the count, the component names and the credits that appear throughout this article.
The brotli entry, CVE-2026-111497, covers an out-of-bounds write that processing maliciously crafted input could turn into memory corruption; Apple credits no one for it. The component is the open-source brotli compression library. 9to5Mac’s Marcus 9to5Mac’s Marcus Mendes wrote that some of the fixes are shared with the 27.2 updates for iOS, iPadOS and macOS.
Group chats and Bluetooth pairing
Two Messages entries carry the most readable risk. CVE-2026-113961 says a remote attacker may be able to join an iMessage group chat and receive its messages. CVE-2026-113960 says a user added to an iMessage group may be able to access messages sent before joining. Apple credits an anonymous researcher for both, and says the first was fixed through The two bugs are related in that both concern who can see a conversation, but they differ in kind: one involves an outsider, the other someone who was legitimately added to a group.
The pairing set is larger. CVE-2026-113965 lets a malicious Bluetooth device establish a pairing without user interaction, and CVE-2026-113964 lets a nearby attacker bypass the pairing-attempt rate limit. CVE-2026-113968 and CVE-2026-113969 cover rate-limit bypasses on pairing code attempts, one over Bluetooth through AirPlay and one from the same network through rapportd. CVE-2026-113970 is a Bluetooth use-after-free that could corrupt process memory.
The ninth, CVE-2026-113963, sits in App Intents, where an app may be able to access sensitive user data; The impact line is brief, and the fix is described as an authorization issue addressed with improved state management, with no further technical detail published.
Who found the bugs, and what Apple has not said
Apple’s own teams are credited on four of the nine: the two Bluetooth-range rate-limit and use-after-free issues, the CoreUtils pairing flaw and the rapportd bypass. Anonymous researchers are credited on three, and one name appears for App Intents, and the brotli entry carries no credit. The document does not say how any bug was found.
Apple’s release notes are silent on whether any flaw was exploited, and on how many units will need the update at launch. The Apple newsroom announcement puts sales at Nov. 13 in the U.S., UK, Canada, Australia, India, New Zealand, Singapore and, through resellers, South Africa. Greg Joswiak, Apple’s senior vice president of Worldwide Marketing, said in it that HomeView “is designed to be shared by everyone in the home yet feel completely personal to each user.”
Mendes’ report for 9to5Mac, which Apple’s own document does not duplicate, also frames the release as a pre-sale patch. His piece lists the same set of fixes under plain-language headings: group-chat access, Bluetooth pairing, pairing rate limits, memory corruption, app data access and group message history. The build is 24V526, according to that report, and the update shares some fixes with the recent 27.2 releases of iOS, iPadOS and macOS Golden Gate.
The newsroom page describes the product as a seven-inch Liquid Retina display on a domed speaker base that plays music and video, handles FaceTime calls and controls smart home accessories, priced at $299 in the U.S. for the tabletop and wall-mounted models alike. It is not sold in the European Union, because Siri AI is currently unavailable in iOS there.
Shared use is where the Messages fixes matter. A device built to be used by several people recognizes up to six faces, so a flaw that exposes group-chat history reaches more than one account holder. Mendes wrote that buyers receiving the device from Nov. 13 should update as soon as possible, since the vulnerabilities are now publicly documented on Apple’s security releases page. Apple’s newsroom says pre-orders opened on Oct. 13, so many buyers ordered the device weeks before any patch existed, and whether Apple ships a 27.2 build preinstalled in the box remains unanswered.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Two Kentucky residents died when a small plane crashed at Missouri’s Lake of the Ozarks, and the NTSB is investigating
- A handful of car transmissions are so tough that mechanics say they almost never die
- Melting permafrost is setting off a newly identified kind of catastrophic landslide, scientists say
- Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
