Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE

Key Takeaways

• Apple has released iOS 27.2 and iPadOS 27.2, addressing a substantial 163 security vulnerabilities.
• The update is critical due to numerous WebKit flaws, including several that could enable remote code execution (RCE) via malicious web content.
• Affected devices include iPhone 11 and later models, along with a broad range of iPads.
• While Apple has not reported active exploitation, immediate patching is strongly advised to mitigate significant risks, including sandbox escapes and kernel-level vulnerabilities.

Apple Rolls Out Critical Security Updates for iOS and iPadOS Devices

Apple has deployed a significant security update, iOS 27.2 and iPadOS 27.2, on October 26, 2026, to address a staggering 163 distinct security vulnerabilities. This extensive patch is crucial for users of iPhone 11 and newer models, as well as a wide array of iPad devices. The most severe issues corrected in this release are concentrated within WebKit, the foundational engine powering Safari and most in-app browsers across Apple’s ecosystem. The company explicitly warned that specially crafted web content could lead to remote code execution (RCE) on vulnerable devices, underscoring the urgency of this update.

A comprehensive list of these security fixes is detailed in Apple’s official security content document for iOS 27.2 and iPadOS 27.2. While Apple has not indicated any of these flaws are currently being actively exploited in the wild, the public disclosure of these vulnerabilities necessitates immediate action from users. Once details of such flaws become public, unpatched devices become prime targets for malicious actors.

WebKit RCE Vulnerabilities Demand Immediate Attention

The WebKit rendering engine accounts for the largest segment of resolved issues in this update, with over 30 vulnerabilities patched. Several of these critical flaws could permit arbitrary code execution if a user inadvertently visits a malicious webpage. These serious vulnerabilities encompass use-after-free bugs and a type confusion error.

In essence, these flaws mean the browser could improperly manage memory after a webpage is closed or misinterpret data types. An attacker could then leverage these memory handling errors to execute their own code within the browser’s process. Specific code execution vulnerabilities addressed include CVE-2026-112697, CVE-2026-112655, CVE-2026-112651, and CVE-2026-112623, all linked to use-after-free conditions. CVE-2026-112659 is identified as a type confusion issue. Additional use-after-free bugs, CVE-2026-112637, CVE-2026-112626, and CVE-2026-112639, were also fixed across WebKit, WebKit Canvas, WebKit JavaScript bindings, and the WebKit process model.

Apple credits improved memory handling for resolving these issues, acknowledging contributions from researchers such as OpenAI Codex Security’s Amy Burnett, Chris Rohlf from Anthropic Research, Euntae Jang, and Luke Francis, among others.

Further exacerbating the risk are two related sandbox escape vulnerabilities. CVE-2026-113897, addressed by removing vulnerable code, allowed a remote attacker to break out of the Web Content sandbox. Similarly, CVE-2026-112690, reported by Claudio Bozzato and Francesco Benvenuto of Cisco Talos and listed under App Store, also permitted remote attackers to escape the WebContent sandbox. A successful sandbox escape is critical as it allows code initially confined to the browser to gain broader access to the device’s resources.

Historically, WebKit vulnerabilities have been a frequent target for real-world attacks, including targeted spyware campaigns. While this particular release does not carry an active exploitation warning, this established pattern underscores why browser-related fixes for iPhones and iPads are consistently treated with high urgency.

Kernel, Privacy, and File System Vulnerabilities Add to the Patch Load

Beyond WebKit, the update also addresses approximately 15 kernel-level bugs. Several of these could lead to system crashes or corruption of kernel memory. Identified use-after-free flaws include CVE-2026-65350, CVE-2026-112679, CVE-2026-112517, and CVE-2026-112514. Other kernel vulnerabilities could allow for writing to kernel memory or disclosing the kernel’s memory layout, which aids attackers in planning more profound system compromises.

Kernel bugs typically require a malicious application or an existing foothold on the device, making them less direct attack vectors than web-based flaws. Nevertheless, they are critical components in exploit chains, where a WebKit vulnerability might serve as the initial entry point, followed by a kernel bug for deeper system access.

Privacy-related vulnerabilities are also patched across various common applications. An Apple Intelligence flaw, CVE-2026-86987, could enable a remote attacker to access sensitive user data on iPhone 15 Pro and later, as well as supported iPads. This was reported by Richard Hyunho Im of Route Zero Security. A logic error in “Hide My Email,” CVE-2026-112500, could inadvertently expose a user’s real email address. Additional fixes cover Contacts, Calendar, CloudKit, Files, Photos, Siri, Shortcuts, and Screen Time. A Maps bug, CVE-2026-112707, had the potential for an application to detect other installed apps, and a CoreMedia flaw, CVE-2026-86990, could allow a malicious app to utilize the camera without explicit user consent.

A significant number of fixes also target file parsing vulnerabilities across components like ImageIO, CoreGraphics, CoreAudio, FontParser, and Model I/O. These issues, triggered by maliciously crafted images, PDFs, fonts, audio, and 3D models, could lead to app termination or memory leaks. Some could also corrupt memory, a step towards arbitrary code execution if an attacker can control file opening. Notably, a CoreMedia bug, CVE-2026-112688, could result in code execution during file parsing.

Jailbreak Fixes and Update Recommendations

The update also includes fixes that impact jailbreaking efforts. Six entries in the advisory credit “Calif,” the team responsible for demonstrating an untethered jailbreak on iOS 27.0.1 and the iPhone Duo on its launch day. Calif researcher Stefan Esser has confirmed that most of the vulnerabilities exploited for that jailbreak have been addressed in iOS 27.2. This development enhances device security while posing a challenge for the jailbreak community, highlighting the rapid public research that often follows jailbreak demonstrations and the risks of delaying patches.

For devices not yet upgraded to iOS 27, Apple simultaneously released iOS 26.7.2 and iPadOS 26.7.2, which incorporate many of the same critical fixes. Users on the older iOS 26 branch are strongly advised to install 26.7.2 rather than skipping the update due to not being on the latest major release.

Supported hardware for iOS 27.2 includes iPhone 11 and newer, iPad Pro 12.9-inch 4th generation, iPad Pro 11-inch 2nd generation, iPad Air 4th generation, iPad 9th generation, and iPad mini 6th generation.

What You Should Do

• Update Immediately: All eligible iPhone and iPad users should install iOS 27.2 or iPadOS 27.2 without delay. For devices still on the iOS 26 branch, update to iOS 26.7.2.
• Backup Your Device: Before initiating any major point release update, it is always prudent to create a full backup of your device.
• Prioritize for Organizations: IT administrators and cybersecurity teams within organizations should treat this as a high-priority patch due to the severity of the WebKit remote code execution flaws, sandbox escapes, and the extensive kernel vulnerability set.
• Enable Automatic Updates: Consider enabling automatic updates to ensure your devices receive critical security patches promptly.
• Exercise Caution: Even after updating, remain vigilant when clicking on links from unknown sources or visiting unfamiliar websites, as new threats can emerge.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.