Loading vulnerability…
Camera Permission Bypass in Apple CoreMedia
CVE-2026-86990 is an access-control vulnerability in Apple's CoreMedia subsystem affecting iOS, iPadOS, macOS, and visionOS. Insufficient access restrictions may allow a malicious application to access the device camera without user permission. Apple addressed the issue by improving access restrictions. The specific vulnerable function and underlying implementation details are not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises camera confidentiality and user privacy by allowing an application to obtain camera access without authorization. This could expose sensitive visual information about users and their surroundings. Arbitrary code execution, privilege escalation, and active exploitation are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is established. Until updates are deployed, use application allowlisting and device-management controls to restrict unauthorized application installation and execution, and remove untrusted applications. These controls reduce exposure but do not replace patching.
Patch, then assume compromise.
Install the applicable fixed release or a later supported security update: iOS and iPadOS 18.7.11, 26.7.2, or 27.2; macOS Golden Gate 27.2; macOS Tahoe 26.7.2; or visionOS 27.2. These releases introduce improved access restrictions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.