Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
CVE-2026-112678
Permissions flaw lets an app read sensitive data on Apple devices
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apple fixed a permissions issue by adding restrictions on iOS, iPadOS, macOS, visionOS, and watchOS. A local app may access sensitive user data. The flaw is triggered by an app on the device, not by a remote unauthenticated request. Users of the listed Apple operating systems before the stated updates are affected.
What to do: Install the fixed releases: iOS and iPadOS 26.7.2 or 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, and watchOS 27.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 26.7.2 and 27.2 |
| Apple iPadOS | — | 26.7.2 and 27.2 |
| Apple macOS Golden Gate | — | 27.2 |
| Apple macOS Sequoia | — | 15.8.2 |
| Apple macOS Tahoe | — | 26.7.2 |
| Apple visionOS | — | 27.2 |
| Apple watchOS | — | 27.2 |
Estimated exposure
largeLarge Apple device base; local app required — Apple platforms are widely deployed, but an installed app must run to reach the data.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. An app may be able to access sensitive user data.
- Weakness
- CWE-862
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N