Apple's iOS 27.2 update protects your data and stops malicious apps from accessing your camera and Bluetooth without permission. Here's why you should update.
On Monday, only days after the iPhone Duo reached customers, Apple made iOS 27.2 available for download. The update includes well over 130 security enhancements, and 25 of them prevent attackers from accessing sensitive user data.
Notably, Apple patched an Accounts and App Intents issue that made it possible for apps to view private user information. The two vulnerabilities were resolved with additional entitlement checks, says Apple's website.
Authorization issues with the App Store, CloudKit, Photos storage, Quick Look, Shortcuts, and Siri were addressed through improved state management. Apple also resolved a privacy vulnerability in the Contacts app by removing sensitive data and fixed permissions issues with the Calendar and CoreMedia frameworks.
Similar now-patched vulnerabilities were found in the FileProvider, Files, FontParser, HomeKit, MediaAnalysis, ReplayKit, and Safety Check frameworks. None of the aforementioned issues were actively exploited by attackers, and all of them are resolved as of the release of iOS 27.2.
Additionally, Apple resolved a Hide My Email vulnerability that left the user's original email address exposed, even while using the feature. Improved restrictions were put in place to address the logic issue, says the company.
Meanwhile, a now-resolved Maps security issue made it possible for select apps to see all the applications installed on an iPhone. iOS 27.2 fixes this vulnerability by moving this data to a private location.
Monday's software update also stops attackers from accessing users' Photos libraries, thanks to additional entitlement checks. The System Settings app, meanwhile, received an update that prevents malicious apps from accessing restricted system interfaces.
Similarly, Apple included four security patches that stop applications from bypassing users' Privacy preferences. The now-resolved issues were present in the Accounts and Photos Storage frameworks, the kernel, and Spotlight.
iOS 27.2 stops apps from accessing Bluetooth and using the camera
While many of the fixes present in the iOS 27.2 update involve keeping user data safe, some of the security enhancements prevent bad actors from accessing key hardware features.
For instance, enhanced access restrictions in iOS 27.2 prevent maliciously crafted applications from accessing the iPhone's cameras without user knowledge or permission.
Similarly, Apple patched an AccessorySetupKit framework issue that let malicious apps access Bluetooth without explicit user permission. This authentication vulnerability was addressed through improvements to state management.
Apple's iOS 27.2 prevents denial-of-service attacks, arbitrary code execution, more
Another now-patched Bluetooth vulnerability made it possible for attackers in physical proximity to cause denial-of-service attacks. Improved validation was used for the null pointer dereference.
In total, the iOS 27.2 update includes six patches that prevent denial-of-service (DOS) attacks, affecting the Mail app, SceneKit, and Wi-Fi framework.
Monday's iOS update also includes multiple enhancements to prevent arbitrary code execution, memory corruption, unexpected app and system terminations, Web sandbox escapes, and more. The full list of security fixes is available on Apple's website.
Overall, iOS 27.2 includes well over 130 fixes, targeting a wide variety of vulnerabilities. Unlike other iOS releases, though, Monday's software update doesn't include fixes for vulnerabilities that were used in targeted attacks.
Even so, AppleInsider recommends installing the iOS 27.2 update to ensure your devices have the latest security enhancements.
