Apple fixed 163 vulnerabilities in iOS 27.2 and 263 in macOS Golden Gate 27.2. Both updates came out on October 26, and both are worth installing today.
Apple’s security pages for iOS 27.2 and iPadOS 27.2 and macOS Golden Gate 27.2 list every fix by component. The iOS update covers the iPhone 11 and later, and 140 of the same CVEs also appear on the macOS list.
WebKit and the kernel take up the biggest share of the iOS fixes
WebKit leads the iOS list with 26 entries, followed by the kernel with 15, ImageIO with 11, and AVEVideoEncoder and Model I/O with 6 each. Eight of the WebKit fixes cover maliciously crafted web content that could lead to arbitrary code execution.
The most common impact on iOS is an app being able to access sensitive user data, which shows up 22 times. Another 11 entries describe an app causing unexpected system termination or corrupting kernel memory.
Several fixes cover files rather than web pages. A maliciously crafted image, font, 3D model or PDF could cause an app to crash or disclose process memory before the patch.
Accounts, Mail, Photos Storage, Spotlight and Wi-Fi have three entries each, and Siri, Bluetooth, HomeKit, Calendar and Shortcuts have two each, which covers the smaller components. Four entries cover attackers who only need to be nearby, with two for an attacker in physical proximity causing a denial of service and two for an attacker in radio range causing unexpected system termination. Two more say an app may be able to bypass Privacy preferences, and two say an app may be able to fingerprint the user.
macOS Golden Gate 27.2 carries 100 more fixes than iOS 27.2
The macOS list has the same 26 WebKit entries, plus 17 kernel entries, 13 for CoreStorage, 11 for ImageIO, 9 for Security and 8 for Model I/O. Screen Sharing Server has 7 entries of its own, which is a component an iPhone does not have.
macOS also carries fixes that iOS does not. Thirteen entries say an app may be able to gain root privileges, and 15 mention arbitrary code execution in some form.
Apple credits Anthropic Research and OpenAI for several of the WebKit and kernel fixes, including CVE-2026-112615, CVE-2026-112659 and CVE-2026-112698.
Both updates install from Software Update
On the iPhone, open Settings, then General, then Software Update. On a Mac, open System Settings, then General, then Software Update.
Older Macs have their own patches in the macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2 security updates, which are out as well.
