Apple iOS 27.2 fixes 163 flaws, including critical WebKit RCE
The release addresses memory corruption, sandbox escape, kernel writes, and unauthorized access to sensitive user data across many components.
74
Vulnerability1 · 1 read
CVE-2026-113908
App access to sensitive user data in iOS and iPadOS
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A privacy flaw in Apple iOS and iPadOS let an app access sensitive user data. Apple addressed it by removing that data. A local app can trigger it; no further authentication or user interaction is described. It is fixed in iOS 27.2 and iPadOS 27.2. Devices still on earlier releases remain affected.
What to do: Update iOS and iPadOS to 27.2, which removes the sensitive data.
| Product | Affected | Fixed in |
|---|---|---|
| Apple iOS | — | 27.2 |
| Apple iPadOS | — | 27.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
- Weakness
- CWE-200
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N