Apple fixes iMessage flaws that exposed private group chats

Apple has issued updates to fix two iMessage vulnerabilities that could allow remote novices to join a group chat and receive messages, along with a separate flaw that could let someone added to a group access messages sent before they joined. Apple’s security notes describe the iMessage issues as CVE-2026-113961 (an authorization problem fixed by improved validation) and CVE-2026-113960 (relating to earlier messages).

The fixes are delivered via operating system updates for iOS and iPadOS 27.2.1, with companion advisories for other devices. The same updates also address a flaw in Google’s Brotli library, CVE-2026-111497, though the notes do not indicate any active exploitation.

The Hacker News report notes that nine updates across affected platforms include Bluetooth and AirPlay protections; several of these could allow a malicious Bluetooth device, or an attacker within Bluetooth range, to pair with a device without user interaction, or to bypass pairing code attempt limits, or to corrupt memory via Bluetooth.

It remains unclear from the article whether any devices on newer versions are affected by the trio of iMessage and Brotli flaws, and whether all group-chat participants must update to stay protected. CISA has catalogued the Brotli vulnerability (CVE-2026-111497) as exploitable, though the security notes do not detail active exploitation or the exact attacker requirements. The report also states there is no provided workaround for those unable to update immediately.