Security Bite: This iOS 27.2 camera bug still isn’t enough to make me buy a camera cover

9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. On Security Bite, it’s one of my favorite pastimes to explain why camera covers are virtually useless today. I’ve been called out plenty of times for it. So when Apple patches a bug that lets a malicious app get access to the camera without permission, I find myself in a rather precarious situation. This week, Apple released iOS 27.2 to the public, and with it, over 160 different vulnerability patches. One of them fixes a bug that could let a malicious app access an iPhone’s or Mac’s camera without the user’s permission. Rest assured, this is not a hardware issue. Apple’s post-2008 change that put the camera module and the green LED indicator on the same circuit is not at fault here. The bug, tracked as CVE-2026-86990 and credited to researcher Mustafa Calap, lives in CoreMedia, the framework apps use for audio and video. Apple’s notes only say “an access issue was addressed with improved access restrictions.” That means the permission prompt, the one that asks whether an app can use your camera, could effectively be skipped entirely. On the Mac, that prompt comes from a system called TCC (Transparency, Consent, and Control), the gatekeeper that’s supposed to keep apps away from your camera until you say yes. So, am I ordering a camera cover now? No. The green light would still come on (for iPhones that’s the green dot in the status bar rather than a physical LED), because the bug went after the permission, not the indicator. The problem is that the indicator only helps if someone’s there to see it. If you happened to be away from your desk, or your iPhone was face down on the table, there’d be nothing standing between that app and a live feed of the surrounding area. It’s the exact scenario where tools like Patrick Wardle’s OverSight can come in handy. It’s free, open source application, that alerts you every time the camera or mic turns on and which app triggered it. I use it to log activity on all my Macs. Plastic over the camera can’t do that, huh? There’s no indication from Apple that this one was exploited in the wild, which is good news here. Still, it’s important to update to iOS 27.2 and macOS Golden Gate 27.2, or iOS 26.7.2 and macOS Tahoe 26.7.2 if you’re holding off on the new OS. Older iPhones like the XS and XR get it in iOS 18.7.11. And if you’ve never looked, now’s a good time to open Settings > Privacy & Security > Camera on iPhone (System Settings > Privacy & Security > Camera on Mac) and see which apps you’ve actually given access to. You might be surprised to find some that no longer use or don’t recognize. Security Bite is 9to5Mac’s weekly deep dive into the world of Apple security. Each week, Arin Waichulis unpacks new threats, privacy concerns, vulnerabilities, and more, shaping an ecosystem of over 2 billion devices. Every other week on the Security Bite Podcast, he sits down with experts in the field to break down the most pressing topics. FTC: We use income earning auto affiliate links. More.