CVE-2026-86990 in iOS
Summary
by MITRE • 10/26/2026
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The disclosed vulnerability represents a critical failure in iOS and iPadOS privilege management mechanisms, specifically concerning media capture subsystems. The core technical flaw lies within the operating system's authorization framework for hardware peripherals, where the enforcement of explicit user consent was bypassed or inadequately validated by certain application processes. In standard secure operation models, any request to access sensitive input devices such as cameras must trigger a system-level prompt requiring affirmative user approval before granting the necessary entitlements. However, in this instance, the underlying code failed to properly verify that these permissions were granted prior to allowing data stream initiation. This indicates a logic error or race condition within the security boundary enforcement layer, potentially stemming from improper state management when handling asynchronous permission requests or insufficient validation of capability assertions during runtime initialization.
From an operational impact perspective, this flaw allows malicious applications installed on affected devices to silently activate camera hardware and capture images or video without any visual indicator such as the green status dot that typically signals active recording. This constitutes a severe privacy violation, enabling unauthorized surveillance of users in private settings. The absence of user awareness means victims remain oblivious to the exfiltration of sensitive personal data, which could include biometric information, confidential documents visible on screens, or intimate moments captured within their homes. Such capabilities significantly elevate the risk profile for high-value targets and general consumers alike, as it facilitates espionage and identity theft scenarios that are difficult to detect through conventional means since no system alerts are generated during the unauthorized access period.
This vulnerability aligns with CWE-200, which classifies information exposure vulnerabilities where an attacker gains access to sensitive data without proper authorization controls. Furthermore, in terms of adversary behavior mapping under the MITRE ATT&CK framework, this flaw supports techniques associated with T1597, specifically Targeted Information Gathering via Peripheral Capture, and potentially T1056, Input Capture, depending on how the captured media is subsequently processed or transmitted. The lack of user notification also relates to evasion tactics that allow malware to operate stealthily within the device environment for extended periods without triggering security alerts or user intervention mechanisms designed to halt such activities.
Mitigation strategies primarily rely on immediate software updates provided by Apple across all affected platforms, including iOS 18.7.11, iPadOS 18.7.11, iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, and visionOS 27.2. Users must ensure their devices are patched to these specific versions where the access restriction logic has been corrected to enforce strict permission checks before granting hardware access. Beyond patching, organizations should implement Mobile Device Management policies that restrict installation of unverified applications from unknown sources, thereby reducing the attack surface for such exploits. Additionally, users can manually review app permissions within system settings to revoke camera access for any application not explicitly required for their workflow, adding a layer of defense-in-depth against potential future vulnerabilities in permission handling logic.