This article may contain affiliate links. Learn more on our Partner Program page.
With iOS 27.2 and the simultaneously released updates for Mac, Apple Watch, Apple TV, and Vision Pro, Apple has published its longest security list of the fall. The documents detail 329 different vulnerabilities across all systems, including a camera flaw and a bug in Apple Intelligence. Apple is aware of attacks on only one of these vulnerabilities, and that one affects older iPhones.
Since Monday evening, Apple has been distributing iOS 27.2 with new features for iPhone and HomePod. Simultaneously, macOS Golden Gate 27.2, watchOS 27.2, tvOS 27.2, visionOS 27.2, and security updates for older systems were released. The corresponding documents are now available in Apple's overview of security updates. Apple lists 163 CVE numbers for iOS 27.2 and iPadOS 27.2 alone.
Together, the ten documents reveal 329 different vulnerabilities. Because many of these affect multiple systems, the lists contain a total of 1,265 entries. These figures reflect the status as of October 26.
Key Facts at a Glance
- With the updates released on October 26, Apple closes 329 different security vulnerabilities, 163 of which are in iOS 27.2 and iPadOS 27.2.
- A CoreMedia vulnerability allowed apps to access the camera without permission, while a flaw in Apple Intelligence allowed remote access to personal data.
- Eight vulnerabilities in WebKit could lead to the execution of malicious code via specially crafted web content.
- Apple only mentions one vulnerability, the fix for which is delivered in iOS 18.7.11 for iPhone XS and XR.
329 gaps in ten documents
The Mac receives the most fixes: macOS Golden Gate 27.2 lists 263 CVE numbers, followed by the updates for the two previous operating systems. At the bottom of the list is iOS 18.7.11 with three entries for devices that will no longer receive a newer version.
| Update | Devices according to Apple | CVE numbers |
|---|---|---|
| iOS 27.2 and iPadOS 27.2 | iPhone 11 and later, iPad (9th generation) and later | 163 |
| iOS 26.7.2 and iPadOS 26.7.2 | iPhone 11 and newer, iPad (8th generation) and newer | 134 |
| iOS 18.7.11 and iPadOS 18.7.11 | iPhone XS, iPhone XS Max, iPhone XR, iPad (7th generation) | 3 |
| macOS Golden Gate 27.2 | Macs with macOS Golden Gate | 263 |
| macOS Tahoe 26.7.2 | Macs with macOS Tahoe | 213 |
| macOS Sequoia 15.8.2 | Macs with macOS Sequoia | 197 |
| visionOS 27.2 | Apple Vision Pro (all models) | 125 |
| tvOS 27.2 | Apple TV 4K (2nd generation) and newer | 72 |
| watchOS 27.2 | Apple Watch Series 9 and newer | 62 |
| Safari 27.2 | Macs with macOS Sequoia and Tahoe | 33 |
| tvOS 26.6.1 | Apple TV HD, Apple TV 4K (1st generation) | none published |
The iPad specifications are abbreviated; iPadOS 26.7.2 also includes older generations of iPad Pro, iPad Air, and iPad mini, which will not receive iPadOS 27. The iPhone Duo launched with iOS 27.1, for which Apple has not published any CVE entries. iOS 27.2 is therefore the first update for the foldable model with documented security fixes.
Camera, Apple Intelligence and Mail
The most noticeable fix concerns CoreMedia, the system's media framework: A malicious app could exploit the vulnerability to access the camera without permission. Apple closes this vulnerability in iOS 27.2, iOS 26.7.2, iOS 18.7.11, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, and visionOS 27.2.
The flaw in Apple Intelligence only affected devices that support the feature – namely iPhone 15 Pro and newer, as well as compatible iPad models. An attacker could exploit this vulnerability to remotely access personal data; Apple has addressed this permissions issue with stricter security measures.
Under certain circumstances, the real email address could be leaked in the Mail app if the "Hide Email Address" option was used. The iCloud+ feature was already criticized in the summer due to a vulnerability in Apple's alias services. Among the additional acknowledgments for the Mail app, Apple also mentions Dominik Conrads from the German Federal Office for Information Security (BSI), without assigning him a CVE number.
Two further entries are relevant to specific groups. One website was able to use a media format that should actually be blocked in blocking mode for iPhones, iPads, and Macs. And an attacker in the vicinity was able to gain access to a Thread network connecting many smart home devices via specially crafted traffic.
WebKit remains the biggest problem area
A large portion of the list relates to WebKit, the browser engine behind Safari. In the iOS 27.2 documentation, 32 CVE numbers are attributed to WebKit and WebRTC. According to Apple, eight of these could allow malicious web content to execute arbitrary code, while another could cause the system to escape the sandbox environment in which web content runs in isolation.
Several of these findings stem from the security research of AI companies: Apple mentions OpenAI with its Codex Security tool, as well as the Anthropic research team, in its acknowledgments. Anthropic's model Claude already appeared in Apple's acknowledgments during the iOS 27 update in September.
Older iPhones will only receive three fixes
With one exception, Apple has not recorded any evidence of attacks for any of the 329 vulnerabilities. The exception is in iOS 18.7.11: The update introduces a CoreGraphics vulnerability for iPhone XS, iPhone XS Max, iPhone XR, and the 7th generation iPad, which could allow specially crafted files to execute malicious code. Apple states that it is aware of a report suggesting this vulnerability may have been exploited in a highly sophisticated attack against targeted individuals using iOS versions prior to iOS 27.
Apple had already closed this vulnerability for newer devices on September 28th with iOS 26.7.1 following targeted attacks. Besides this fix, iOS 18.7.11 only includes the camera correction from CoreMedia and a fix in the audio system. The WebKit vulnerabilities do not appear in the security list for iOS 18.7.11.
Apple TV HD and the first-generation Apple TV 4K are receiving an update with tvOS 26.6.1, for which Apple has not published any CVE entries.
No immediate attacks, but still no update to postpone
I consider iOS 27.2 one of the updates that shouldn't be left until the weekend – precisely because it doesn't contain any exploited vulnerabilities. If Apple discloses the details of eight WebKit vulnerabilities with potential code execution and one camera vulnerability, attackers will have a template to look for on unpatched devices. Furthermore, the Apple Intelligence vulnerability directly affects devices where personal data is processed using AI.
The update can be installed under Settings > General > Software Update, where you can also enable automatic installation of Apple's security updates. Anyone still using an iPhone XS or XR should also install iOS 18.7.11 as soon as possible. However, the three fixes included in this update also demonstrate how limited the protection for these devices has become: the majority of web browser fixes remain exclusive to systems running iOS 26 and later.
Do you install security updates like iOS 27.2 on the same evening, or do you prefer to wait a few days to see if any bug reports appear? Let us know in the comments how long you wait before installing a new update.
