Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities - The Hacker News

Apple yesterday released security updates to address critical vulnerabilities in iMessage that could allow remote attackers to join group chats and receive messages, as well as access messages sent before they joined the group. The updates also fix a separate flaw in Google's Brotli compression library.

Affected Devices

The fixes are included in iOS and iPadOS 27.2.1, but not in updates for iPhone XS, XS Max, XR, the iPad (7th generation), and some Apple Watch models. The company hasn't specified whether these older devices remain vulnerable or if workarounds are available for users who cannot update immediately.

Bluetooth Vulnerabilities

All nine updates also address multiple Bluetooth and AirPlay flaws. Two could allow malicious Bluetooth devices to pair with Apple devices without user interaction, while others could enable attackers to bypass pairing code limits or corrupt process memory from Bluetooth range.

Exploitation Status

Apple's security notes do not indicate whether any of these vulnerabilities have been exploited in the wild. The Brotli flaw (CVE-2026-111497) was added to CISA's Known Exploited Vulnerabilities catalog on October 27, though no attacks using this flaw have been reported.