Apple Releases iOS 27.2.1 to Fix a Sneaky iMessage Group Chat Privacy Bug
oasisamuel / Shutterstock
Toggle Dark Mode
Apple has just released iOS 27.2.1 for those who haven’t yet taken the plunge into the iOS 27.3 betas that came out last week. Like most sub-point releases, there aren’t any new features here — the update is all about bug fixes, performance improvements, and security patches — but it does fix one or two noteworthy security issues.
There’s no indication that any of these have been actively exploited yet — or if they have, Apple isn’t aware of it. However, like all security patches, the fact that Apple has now published a laundry list of what’s fixed means the bad actors of the world will be looking for ways to exploit these bugs on those who haven’t updated. That’s the number one reason it’s important to install the latest iOS updates as soon as they become available.
However, this one has a more practical security fix that goes beyond the usual loopholes like remote code execution and memory overflows. While those are serious security vulnerabilities, they’re not the sort of things you’re likely to bump up against during everyday use — they simply open the door for malware and spyware to do nasty things on your iPhone.
But this round of fixes includes this little gem:
A user added to an iMessage group may be able to access messages sent before they joined.
Unlike Messenger and WhatsApp, new users who are added to an iMessage group chat are not supposed to be able to see the messages that came before they joined. That’s a useful privacy feature that sets iMessage apart. WhatsApp gives users the choice when they add someone, while Messenger always opens the entire thread, leading many to start a whole new chat when they want to add another member.
As usual, Apple doesn’t describe the circumstances under which this happens, and the word “may” suggests it’s not always the case. It seems like it may be tied to a related issue that Apple describes as, “A remote attacker may be able to join an iMessage group chat and receive its messages,” although the fixes are slightly different.
Nevertheless, the real potential risk to this one is that you wouldn’t have any obvious way of knowing if someone you’d just added to a group chat was able to read everything that came before (unless they told you, of course). That makes it a pretty risky scenario if you’re relying on iMessage’s default behavior to keep your conversation history private.
The actual risk here could range from spoiling someone’s birthday surprise to divulging confidential information in a business discussion, but either way, it’s something that could happen not only in iOS 27.2, but also in iOS 26.7, as Apple also released iOS 26.7.3 today to fix the same issue, “by removing the vulnerable code.”
Alongside those two, iOS 18.7.12 also arrived with some of the same fixes, particularly for AirPlay and Bluetooth, but it doesn’t list the iMessage vulnerability, suggesting that this is something that crept in more recently.
All three updates address an issue where “an attacker in Bluetooth range may be able to corrupt process memory,” or even “establish a pairing without user interaction.” Depending on the nature of that pairing, this could allow an attacker to monitor audio playing on your device or possibly even take control of it.
Apple also released corresponding updates for iPadOS 27.2.1, 26.7.3, and 18.7.12, as well as watchOS 27.2.1 and 26.6.1, visionOS 27.2.1, and macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, and macOS Sequoia 15.8.3, all of which incorporate most of the same AirPlay, Bluetooth, and iMessage fixes, as applicable.
