iOS 27.2 fixes camera permission bug: Is it time to cover your webcam?

Apple has released iOS 27.2, which includes over 160 security patches to address various vulnerabilities. One of the most critical fixes resolves a bug that could allow malicious apps to access the iPhone or Mac camera, completely bypassing the user's explicit permission.

• CVE-2026-86990 vulnerability in CoreMedia allowed apps to bypass the TCC permission system.
• The update covers iOS 27.2, macOS Golden Gate 27.2, and legacy devices via iOS 18.7.11.
• Apple's hardware-linked green indicator light continues to act as a reliable privacy safeguard.
• Experts advise using monitoring tools over physical stickers to ensure data privacy.

Understanding the security loophole The bug, identified as CVE-2026-86990, was discovered within CoreMedia—the core framework responsible for handling video and audio on Apple platforms. Essentially, the bug allowed malicious software to bypass the Transparency, Consent, and Control (TCC) system, which acts as the gatekeeper for privacy permissions. By exploiting this gap, an app could potentially activate the camera without the system prompting the user for approval. However, this is strictly a software issue. Apple’s hardware architecture, which links the camera module and the green activity indicator on a single circuit, remains intact. This means even if the software permission was bypassed, the hardware light would still trigger, alerting the user to the camera's activity.

The ongoing camera cover debate Despite such vulnerabilities, security experts often argue that physical webcam covers or plastic sliders are unnecessary. They offer limited protection against modern surveillance and can potentially damage the screen of a MacBook if closed improperly. Instead, utilizing tools like OverSight is recommended. This open-source utility alerts users every time the camera or microphone is accessed and identifies which process initiated the request, providing significantly more transparency than a simple piece of tape.

Why this matters for the ecosystem For the vast majority of users, the solution remains consistent: keep your devices up to date. Users are urged to install iOS 27.2, macOS Golden Gate 27.2, or the appropriate security update for their specific device model immediately. While there is no current evidence that this vulnerability was widely exploited in the wild, regular maintenance of privacy settings in the System Settings menu remains a best practice. Taking a few moments to review which apps have camera permissions can significantly improve your personal security posture.