Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Bugs
Apple has released a set of security updates that fix two iMessage flaws affecting group chats, according to notes published alongside the patches. The first, tracked as CVE-2026-113961, is an authorization issue that could let a remote attacker join a group chat and receive its messages; Apple says it addressed the problem through improved validation. The second, CVE-2026-113960, could allow someone who was added to a group to read messages that were sent before they joined. Both are privacy problems rather than straightforward code-execution bugs, but they strike at the core promise of a messaging platform: that a conversation stays among the people who are actually in it.
The same updates also fix a flaw in Google's Brotli compression library, tracked as CVE-2026-111497. It is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on October 27, which suggests real-world abuse of the component somewhere in the ecosystem. Apple's notes do not mention any attacks using the Brotli flaw. The security advisory for iOS and iPadOS 27.2.1 describes all three issues, while the notes for iOS 18.7.12 and watchOS 26.6.1 list other fixes but not the iMessage or Brotli patches. Updates released for the iPhone XS, XS Max and XR, the seventh-generation iPad, and some Apple Watch models likewise do not list either iMessage fix, and Apple does not say whether devices on those versions are affected.
Beyond the messaging and compression fixes, all nine updates address Bluetooth and AirPlay flaws. Two of them could allow a malicious Bluetooth device, or an attacker within Bluetooth range, to pair with a target device without any user interaction. Two others could let an attacker bypass the limit on pairing code attempts, one from Bluetooth range and one from the same network, and another could let an attacker in Bluetooth range corrupt process memory. Apple's notes do not explain what a successfully paired device could then do, which leaves the practical impact of those pairing bugs unclear.
What stands out is how much Apple's notes leave unsaid. The company does not indicate whether either iMessage flaw has been exploited, what an attacker would need in order to abuse them, whether group members would notice an unauthorized participant, or whether every member of a group must update for the protection to hold. No workaround is offered for anyone who cannot patch right away. For defenders, the practical takeaway is the familiar one: apply the updates promptly, prioritize the iOS and iPadOS 27.2.1 release since it carries all three fixes, and treat the Bluetooth pairing issues as a reminder that wireless proximity attacks remain a live concern on mobile devices.
Stay secure — stay Wavasec. 🔐
