Apple iOS 27.2 Patches Critical WebKit RCE and 162 Other Vulnerabilities
Apple has released iOS 27.2 and iPadOS 27.2, addressing a total of 163 security vulnerabilities, including critical remote code execution flaws in WebKit.
Apple has issued a significant security update, rolling out iOS 27.2 and iPadOS 27.2 to patch a substantial number of vulnerabilities, totaling 163 across its mobile operating systems. The update, released on October 26, 2026, addresses critical flaws, most notably within the WebKit rendering engine, which powers Safari and many in-app browsers on Apple devices. These WebKit vulnerabilities, including use-after-free bugs and type confusion issues, could allow remote code execution if a user visits a maliciously crafted web page.
The most critical of these WebKit flaws include CVE-2026-112697 and CVE-2026-112659, among others like CVE-2026-112655, CVE-2026-112651, and CVE-2026-112623. These vulnerabilities exploit memory handling errors, enabling attackers to potentially run arbitrary code within the context of the browser. Additionally, two related sandbox escape vulnerabilities, CVE-2026-113897 and CVE-2026-112690, could allow malicious code to break out of the Web Content sandbox, granting it broader access to the device's resources.
Beyond WebKit, the update also tackles approximately 15 kernel vulnerabilities. These flaws can lead to system crashes or kernel memory corruption, and while often requiring a prior foothold or a malicious app to exploit, they are crucial for attackers chaining exploits. Several of these kernel issues are also use-after-free bugs, such as CVE-2026-65350, CVE-2026-112679, CVE-2026-112517, and CVE-2026-112514. Other kernel fixes address memory writing capabilities and memory layout disclosure, which can aid attackers in planning more sophisticated attacks.
Privacy and application-specific vulnerabilities are also addressed. A notable flaw in Apple Intelligence, CVE-2026-86987, could permit remote attackers to access sensitive user data on newer iPhone and iPad models. Another privacy concern, CVE-2026-112500, a logic bug in Hide My Email, could potentially leak a user's real email address. Numerous other fixes are distributed across applications like Contacts, Calendar, CloudKit, Files, Photos, Siri, Shortcuts, and Screen Time, with specific bugs in Maps (CVE-2026-112707) and CoreMedia (CVE-2026-86990) also being resolved.
Several vulnerabilities were also patched in file parsing components, including ImageIO, CoreGraphics, CoreAudio, FontParser, and Model I/O. While many of these issues might only cause application crashes or memory leaks, some, like CVE-2026-112688 in CoreMedia, could lead to code execution when processing crafted files, such as images, PDFs, fonts, or audio files.
The release also includes fixes for vulnerabilities that were reportedly used in jailbreaking attempts. Security researcher Stefan Esser has indicated that many of the bugs exploited in a recent jailbreak demo are now patched. This highlights the importance of timely updates, as public research and exploit development often follow such demonstrations.
Apple has also released iOS 26.7.2 and iPadOS 26.7.2 for devices not yet running iOS 27, containing many of the same fixes. Supported hardware for iOS 27.2 includes iPhone 11 and later, and a range of iPad models starting from the 4th generation iPad Pro. Users are strongly advised to update their devices by navigating to Settings > General > Software Update.
Given the presence of critical remote code execution vulnerabilities in WebKit, sandbox escapes, and a significant number of kernel fixes, organizations should prioritize this update. The combination of browser-exploitable flaws and deeper system vulnerabilities creates a wide attack window for unpatched devices, underscoring the need for prompt deployment of iOS 27.2.