Apple released iOS 27.2 and macOS Golden Gate 27.2 on 26 October 2026. The two point releases deliver substantial security patches: iOS 27.2 fixes 163 vulnerabilities, while macOS Golden Gate 27.2 carries 263 fixes. The company’s security documentation lists the individual CVEs and affected components for both updates.
Who and what the updates cover
Apple’s iOS 27.2 applies to iPhone models back to the iPhone 11 and later. The macOS Golden Gate 27.2 list overlaps heavily with the iOS entries — about 140 CVEs appear on both lists — but Golden Gate contains additional macOS-only fixes and a larger total count.
Major components and impacts
WebKit and the kernel account for a large share of the iOS fixes. The breakdown published by Apple highlights:
- WebKit: 26 entries on the iOS list; several fixes address maliciously crafted web content that could lead to arbitrary code execution
- Kernel: 15 entries on iOS; macOS Golden Gate lists 17 kernel fixes
- ImageIO: 11 entries on iOS
- Model I/O and AVEVideoEncoder: 6 entries each on iOS
Apple’s summaries show the most frequent impact on iOS is an app gaining access to sensitive user data, recorded 22 times. Other common outcomes include unexpected system termination or kernel memory corruption (11 entries). Several fixes address vulnerabilities in file processing — a maliciously crafted image, font, 3D model or PDF could cause an app to crash or disclose process memory prior to the patches.
macOS Golden Gate carries additional and higher‑risk fixes
macOS Golden Gate 27.2 includes the same 26 WebKit items found in iOS, plus higher counts in several categories: 17 kernel items, 13 in CoreStorage, 11 for ImageIO, 9 in Security and 8 for Model I/O. Components unique to macOS such as Screen Sharing Server show multiple entries (seven for that component).
Notably, Golden Gate’s list includes entries stating an app may be able to gain root privileges (13 entries) and arbitrary code execution (15 entries) in some cases, reflecting higher-severity impacts on macOS.
Credits and notable CVEs
Apple credits external researchers and organisations for several fixes. Anthropic Research and OpenAI are named for contributions toward multiple WebKit and kernel patches, including CVE‑2026‑112615, CVE‑2026‑112659 and CVE‑2026‑112698.
What users in India should note
- Both updates were released on 26 October 2026; Apple’s security pages list the full CVE and component details.
- iPhone owners running iPhone 11 or later are covered by iOS 27.2; macOS Golden Gate 27.2 is the current macOS branch receiving these fixes.
- Several vulnerabilities involve arbitrary code execution, privilege escalation and data disclosure; installing the updates will apply Apple’s patches for the listed CVEs.
Apple’s security release pages for iOS and macOS contain the complete lists of fixes and the CVE identifiers. Users and administrators should review those pages for details specific to their devices and configurations.
