GoKawiilApple patches CoreMedia bug in iOS 27.2 that let apps bypass camera permission prompts
Apple's iOS 27.2 update, released this week alongside more than 160 vulnerability fixes, addresses a flaw tracked as CVE-2026-86990 in the CoreMedia framework. The bug, credited to researcher Mustafa Calap, could allow an app to access the camera without triggering the usual permission prompt, though Apple's notes only describe it as improved access restrictions. The issue is software-based and does not involve the camera's hardware LED indicator, which remains tied directly to the camera module.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw undercuts the assumption that a lit camera indicator or a permission dialog guarantees user awareness, since software can apparently route around the TCC consent system on Apple devices. The author argues this still doesn't justify physical camera covers, suggesting the fix addresses the underlying software gap rather than any hardware-level exposure. The vague patch description leaves open questions about how long the bug existed and how it could have been exploited before the fix.
- iOS 27.2 fixes CVE-2026-86990, a CoreMedia bug letting apps bypass camera permission prompts.
- The flaw is software-based and doesn't affect the camera's hardware LED indicator.
- Apple's release notes offer minimal detail, describing it only as improved access restrictions.
Nope Webcam Cover Slide — If stories like this iOS camera bug make you want extra peace of mind regardless of software patches, a slim adhesive camera cover is a simple physical backstop. It's inexpensive, reusable, and lets you instantly block your lens without relying on permissions or patches. A nice low-tech complement to good security hygiene.
See Nope Webcam Cover Slide on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: 9to5mac.com — Arin Waichulis, 2026-10-30
Published there as: “Security Bite: This iOS 27.2 camera bug still isn’t enough to make me buy a camera cover”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.