Apple patches iMessage flaws that could expose private group chats to outsiders

Apple has released security updates across its operating systems to address vulnerabilities in Messages, including two flaws that could let unauthorized access to iMessage group conversations and expose messages sent before a participant joined.

Apple has patched two privacy vulnerabilities in its Messages app that could have allowed outsiders to access private group conversations or newly added participants to read messages they were never meant to see.

The flaws, disclosed in security advisories accompanying Apple's Nov. 9 software updates, affect the way iMessage handles group membership and access to conversation history.

One vulnerability could allow a remote attacker to join an iMessage group chat and receive its messages. The other could expose earlier messages to someone legitimately added to a conversation.

Both issues, reported by an anonymous security researcher, have been addressed in the latest iOS and iPadOS updates.

Key points

• Apple has patched two Messages vulnerabilities affecting the privacy of iMessage group conversations
• One flaw could let a remote attacker join a group chat and receive its messages without proper authorization
• Another could expose messages sent before a new participant joined a conversation
• Fixes are included in iOS and iPadOS 27.2.1 and 26.7.3, macOS Golden Gate 27.2.1, and macOS Tahoe 26.7.3, released Nov. 9
• Apple has not publicly reported active exploitation of either vulnerability

Two flaws put iMessage group privacy at risk

The more concerning vulnerability of the two, tracked as CVE-2026-113961, involves an authorization weakness in Messages.

According to Apple's security advisory, the flaw could allow a remote attacker to join an iMessage group conversation and receive its messages.

Apple addressed the issue by improving authorization validation, preventing unauthorized participants from gaining access through the vulnerable mechanism.

The second vulnerability, CVE-2026-113960, concerns access to conversation history.

Under normal circumstances, someone newly added to an iMessage group shouldn’t automatically be able to see messages that were exchanged before they joined.

However, Apple says the flaw could let a new participant retrieve earlier messages, potentially exposing private conversations to people who were not originally part of them.

Rather than adjusting the authorization checks, Apple resolved this vulnerability by removing the affected code.

Apple's advisories don’t indicate that either flaw has been exploited in real-world attacks. They also provide no details about the discovery process or the circumstances required to exploit the vulnerabilities.

Apple releases security updates across its platforms

Apple addressed the Messages vulnerabilities in its Nov. 9 security releases, alongside other fixes affecting Bluetooth, AirPlay and system components.

For iPhone and iPad users, the company explicitly lists both Messages fixes in iOS 27.2.1 and iPadOS 27.2.1, iOS 26.7.3 and iPadOS 26.7.3 on the mobile side, as well as in macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3 on the desktop side.

The latest releases cover iPhone 11 and newer devices, while the supported iPad models vary depending on the operating system version.

Apple also released security updates for older iPhones and iPads running iOS 18, as well as for Apple Watches and Vision Pro headsets.

Here’s the Nov. 9 release lineup:

Importantly, not every update addresses the same vulnerabilities, but they all carry important patches of their own.

How to protect your iDevice

The most important precaution is to install the latest security updates on every Apple device used for messaging.

On an iPhone or iPad, open Settings → General → Software Update and install the available update. Mac users can check System Settings → General → Software Update.

Users should also review the participants in sensitive iMessage group conversations, particularly after someone new is added, and verify that everyone belongs there.

Enable automatic security updates to help ensure future patches are installed promptly.

For peace of mind, use independent security software to help detect malicious links and downloads, and other threats that may accompany a cyberattack.

On topic:

Apple warns German politicians their iPhones may be infected with spyware

Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flaw

Pegasus spyware infects iPhone of Serbian university rector who supported student protests