On Security Bite, I often explain why camera covers are virtually useless today, so when Apple patches a bug that lets a malicious app access the camera without permission, I find myself in a precarious position.
This week, Apple released iOS 27.2 to the public, with over 160 different vulnerability patches. One of them fixes a bug that could let a malicious app access an iPhone's or Mac's camera without the user's permission. This is not a hardware issue. Apple's post-2008 change that put the camera module and the green LED indicator on the same circuit is not at fault here.
The bug, tracked as CVE-2026-86990 and credited to researcher Mustafa Calap, lives in Core Media, the framework apps use for audio and video. Apple's notes only say "an access issue was addressed with improved access restrictions." That means the permission prompt, which asks whether an app can use your camera, could effectively be skipped entirely. On the Mac, that prompt comes from TCC (Transparency, Consent, and Control), the gatekeeper meant to keep apps away from your camera until you say yes.
So, am I ordering a camera cover now? No. The green light would still come on, because the bug went after the software layer rather than the indicator itself. The indicator still signals camera use, but a camera cover remains unnecessary for this type of flaw. Users should simply install the iOS 27.2 update to close the vulnerability.
Source: 9to5Mac · Summarized by HeadlinesBriefing