Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

Apple has shipped fixes for two iMessage weaknesses that affected group chats: one, tracked as CVE-2026-113961, could reportedly let a remote attacker join a group conversation and read its messages through an authorization flaw now closed with stronger validation, while the other, CVE-2026-113960, could allow someone newly added to a group to view messages exchanged before they joined. The same batch of updates also patches CVE-2026-111497, an out-of-bounds write bug in Google's Brotli compression library decoder that CISA added to its Known Exploited Vulnerabilities catalog on October 27, as well as several Bluetooth and AirPlay issues, including two that could allow pairing without user confirmation and others tied to bypassing pairing-attempt limits or corrupting memory from within Bluetooth range. Notably, the iOS and iPadOS 27.2.1 advisory covers all three main flaws, but parallel updates for older devices like the iPhone XS, XS Max, XR, 7th-generation iPad, and some Apple Watch models — including iOS 18.7.12 and watchOS 26.6.1 — make no mention of the iMessage or Brotli fixes, leaving it unclear whether those devices remain exposed. Apple has not disclosed exploitation details, attacker requirements, or any workaround for users unable to update immediately.