GoKawiilApple patches CoreMedia bug in iOS 27.2 that let apps bypass camera permission prompts
Apple's iOS 27.2 update, released this week alongside more than 160 vulnerability fixes, addresses a flaw tracked as CVE-2026-86990 in the CoreMedia framework. The bug, credited to researcher Mustafa Calap, could allow an app to access the camera without triggering the usual permission prompt, though Apple's notes only describe it as improved access restrictions. The issue is software-based and does not involve the camera's hardware LED indicator, which remains tied directly to the camera module.