On October 26, Apple released a batch of security updates affecting iPhones, iPads, and Macs. iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, macOS Sequoia 15.8.2, and Safari 27.2 all came out the same day. The security documents Apple published list 163 separate CVE numbers for iOS 27.2 and 263 for macOS Golden Gate 27.2.
Most of the vulnerabilities are memory management bugs. These kinds of bugs can cause an app to crash or allow an attacker to execute code on the device when a maliciously crafted web page or file is opened.
The risk of code execution from the web
The most critical part of the update is the use-after-free vulnerabilities fixed in WebKit. For CVE-2026-112623, CVE-2026-112637, and CVE-2026-112655, Apple states that processing maliciously crafted web content could lead to arbitrary code execution. NVD assigns these vulnerabilities a score of 8.8. The same issues were also fixed in iOS 26.7.2, iPadOS 26.7.2, macOS, tvOS, watchOS, and visionOS 27.2 releases; the iOS 26.7.2 document lists similar vulnerabilities such as CVE-2026-112626, CVE-2026-112651, and CVE-2026-112659.
With CVE-2026-112690, reported by Cisco Talos researchers Claudio Bozzato and Francesco Benvenuto, a remote attacker could escape the WebContent sandbox. This vulnerability, fixed in iOS and macOS releases, had bypassed the sandbox that prevented content delivered through the browser from accessing the rest of the system. The list also includes three other entries that directly affect users: with CVE-2026-84493, an app could access Bluetooth without asking for permission; with CVE-2026-112612, an attacker with physical access could read and write files on a paired device; and with CVE-2026-112622, an attacker within radio range could crash the system over Wi-Fi.
Root privileges and Gatekeeper on Macs
The highest-risk bug on the desktop side is CVE-2026-112438. According to Apple’s description, an unauthorized attacker could execute code as root through this vulnerability. The bug was fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2, and macOS Sequoia 15.8.2, and it has an NVD score of 8.8.
In addition, two Gatekeeper bypass vulnerabilities were fixed: with CVE-2026-86937, an app could bypass the Gatekeeper check, and with CVE-2026-112568, a maliciously crafted file could bypass it. On the APFS side, three vulnerabilities that process disk images (CVE-2026-84496, CVE-2026-112536, CVE-2026-112525) could lead to kernel memory reads and writes, and bugs in Apple Neural Engine and AppleAVD could cause memory corruption with a maliciously crafted video file.
Which version to install on which device
- iPhone 11 and later, new iPads: via Settings > General > Software Update for iOS 27.2 / iPadOS 27.2.
- iPhone XS, XS Max, XR, and iPad (7th generation): iOS 18.7.11 and iPadOS 18.7.11 have been released; these devices are not getting the 27.x release.
- Mac: In System Settings > General > Software Update, you’ll see Golden Gate 27.2, Tahoe 26.7.2, or Sequoia 15.8.2.
- Safari: For users on macOS Sequoia and Tahoe, Safari 27.2 was released as a separate update.
- Other devices: Apple TV 4K (2nd generation and later) gets tvOS 27.2, Apple Watch Series 9 and later get watchOS 27.2, and Vision Pro gets visionOS 27.2.
Apple’s announcements do not mention these vulnerabilities being actively exploited, and these CVEs are not on CISA’s KEV list either. Still, because WebKit vulnerabilities can be triggered just by clicking a link, you shouldn’t delay the update. Even if automatic updates are enabled, it’s worth checking manually for Safari and macOS.
Source: Apple Security Advisories · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.