Apple Patches iMessage Flaws Exposing Group Chat Messages

Apple has released security updates addressing critical iMessage privacy flaws that could allow a remote attacker to join a group chat and receive incoming messages. A separate vulnerability allows newly added users to access previous chat history. The vendor also resolved an out-of-bounds write flaw in Google's Brotli compression library, as well as multiple Bluetooth and AirPlay vulnerabilities across nine updates that could permit unauthorised pairing without user interaction or memory corruption within radio range.

Key Facts

What Are the iMessage and Brotli Vulnerabilities?

Apple patched two distinct iMessage flaws alongside a flaw in Google's Brotli compression library. One iMessage issue allows remote attackers to join group chats and intercept incoming messages, while another lets newly added users read prior discussions. The Brotli flaw involves an out-of-bounds write that can corrupt system memory.

The flaw enabling remote actors to enter group chats is registered as CVE-2026-113961, described as an authorisation issue resolved via improved validation. The vulnerability exposing earlier conversation history is tracked as CVE-2026-113960. Meanwhile, Google's Brotli decoder vulnerability, CVE-2026-111497, stems from an out-of-bounds write where malicious input corrupts process memory. While Apple's advisory notes do not mention active exploitation for the Brotli bug, the component was previously added to the Known Exploited Vulnerabilities catalog maintained by cisa.gov on 27 October.

The security advisory for iOS and iPadOS 27.2.1 describes fixes for both iMessage flaws and the Brotli decoder vulnerability.

Are Bluetooth and AirPlay Connections Also at Risk?

All nine operating system updates delivered by Apple resolve Bluetooth and AirPlay security vulnerabilities. These flaws could allow an attacker or malicious device within physical range to pair without any user interaction, bypass limit thresholds on pairing code attempts, or corrupt process memory on affected Apple hardware.

Two of the patched vulnerabilities allow an attacker within Bluetooth range, or a rogue Bluetooth device, to complete pairing without requiring user approval, though Apple's release notes do not clarify what actions a paired device can subsequently perform. Two additional flaws permit an attacker to bypass brute-force limits on pairing passcode attempts—one executable from Bluetooth range and the other from across the local network. A fifth vulnerability permits an attacker situated within Bluetooth proximity to corrupt memory processes.

Apple released fixes across nine update releases to mitigate zero-interaction pairing and memory corruption risks over Bluetooth and AirPlay.

What Should You Do?

• Update affected Apple devices to official fixed releases, such as iOS and iPadOS 27.2.1, to remediate the iMessage and Brotli vulnerabilities.
• Install available vendor operating system updates across supported platforms, noting that Apple has offered no workarounds for users unable to update immediately.
• Report suspected unauthorized device intrusions or related cyber security incidents in Malaysia to Cyber999 (MyCERT).

Common Questions

Has Apple confirmed active exploitation of the iMessage flaws?

Apple has not stated whether either iMessage flaw has been actively exploited in attacks. Furthermore, official advisory notes do not specify what prerequisites an attacker requires, whether existing chat members can detect the uninvited participant, or if all participants must patch to remain secure.

Are older devices like the iPhone XS protected against the iMessage bugs?

Updates released for the iPhone XS, XS Max, XR, iPad 7th generation, and select Apple Watch models do not list fixes for the iMessage flaws. Apple has not clarified if devices running those software releases remain affected by the vulnerabilities.

What are the risks associated with the Brotli library flaw?

The Brotli vulnerability, tracked as CVE-2026-111497, is an out-of-bounds write flaw in the library's decoder. It allows malicious input to corrupt memory. Although Apple reports no active attacks, the flaw was catalogued as known exploited by CISA on 27 October.

Sources and Methodology

This dispatch is based solely on reporting published by The Hacker News on Nov 10, 2026. No independent review or verification of underlying vendor release notes, advisories, or third-party databases was conducted.