Apple updates fix exploited Brotli flaw and iMessage privacy flaws

Apple released iOS 27.2.1 and iPadOS 27.2.1 on 9 November 2026, with fixes for a Brotli vulnerability and two iMessage group-chat privacy flaws. The US Cybersecurity and Infrastructure Security Agency had added the Brotli flaw to its catalog of known exploited vulnerabilities on 27 October.

The listing establishes that the Brotli vulnerability has been exploited, but not that Apple devices were attacked. Apple’s notes do not mention attacks using the flaw or say whether either iMessage flaw has been exploited, The Hacker News said.

What the flaws could expose

Apple said CVE-2026-113961 could let a remote attacker join an iMessage group chat and receive its messages. The update fixes the authorization issue by improving validation. The separate flaw, CVE-2026-113960, could let someone added to a group see messages sent before they joined.

The Brotli flaw, CVE-2026-111497, affects a decoder in Google’s compression library, a component that different products could use. Malicious input could cause it to write outside its intended memory area and corrupt memory.

Updates for older devices

Apple’s notes for iOS 18.7.12 and watchOS 26.6.1 list other security fixes but not the three Brotli and iMessage fixes. Updates for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models do not list either iMessage fix. Apple has not said whether devices on those versions are affected by the three flaws.

Apple’s notes also do not specify what an attacker would need to exploit the iMessage flaws, whether group members would see an unauthorized participant or whether every member must update for protection. The notes offer no workaround for users who cannot update immediately.