Apple released updates after an iMessage flaw was said to let a remote attacker join a group chat and receive its messages. The company also fixed a separate iMessage flaw that could let someone added to a group read messages sent before they joined.
Apple update notes and iMessage flaws
As of today, the company’s notes for the iPhone XS, XS Max and XR, the iPad 7th generation, and some Apple Watch models do not list either iMessage fix. Apple also does not say whether either flaw has been exploited, what an attacker would need, whether group members would see someone who joined this way, or whether every member must update before protection is in place.
The flaw that could allow a remote attacker to join a group chat is tracked as CVE-2026-113961. Apple describes it as an authorization issue and says the updates address it through improved validation. The separate message-access flaw is CVE-2026-113960, and the company’s notes do not give further detail beyond the ability to reach earlier messages.
Update coverage across Apple platforms
Each operating system version received its own update. The security advisory for iOS and iPadOS 27.2.1 covers all three flaws, and the security releases page links to the notes for every update. The iOS 18.7.12 notes and the watchOS 26.6.1 notes list other security fixes, but they do not list the iMessage or Brotli fixes. Apple also gives no workaround for people who cannot update right away.
Google Brotli flaw and CISA listing
The updates that fix the iMessage issues also fix a flaw in Google’s Brotli compression library. Apple’s notes do not mention any attacks using that flaw, and CISA added it to its Known Exploited Vulnerabilities catalog on October 27. The Brotli issue is CVE-2026-111497, an out-of-bounds write in the library’s decoder that could let malicious input corrupt memory. CISA’s catalog entry names Google’s Brotli as the affected product and says different products could use the component.
Bluetooth and AirPlay fixes in the same releases
All nine updates also fix Bluetooth and AirPlay flaws. Two of them could let a malicious Bluetooth device, or an attacker within Bluetooth range, pair with a device without user interaction, but the notes do not say what a paired device could do next. Two more could let an attacker bypass the limit on pairing code attempts, one from Bluetooth range and one from the same network. Another could let an attacker in Bluetooth range corrupt process memory.
Licensed under CC BY-ND 4.0 International