Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it.
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it.
The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models do not list either fix.
The company's notes also do not say whether either flaw has been exploited, what an attacker would need, whether group members would see someone who joined this way, or whether every member must update to be protected.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 27.
The company does not say whether devices on those versions are affected by the three flaws.
CISA's catalog entry for the Brotli decoder flaw names Google's Brotli as the affected product and says different products could use the component.
The flaw that could let a remote attacker join a group chat is tracked as CVE-2026-113961; the Brotli flaw, CVE-2026-111497, is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory.
The updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library; it is an authorization issue that the updates fix through improved validation.
The security releases list links to the notes for every update, and its notes also offer no workaround for anyone who cannot update right away.
What happened
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it.
The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.
As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Watch models do not list either fix.
What changed
The company's notes also do not say whether either flaw has been exploited, what an attacker would need, whether group members would see someone who joined this way, or whether every member must update to be protected.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 27.
Who is affected
The company does not say whether devices on those versions are affected by the three flaws.
CISA's catalog entry for the Brotli decoder flaw names Google's Brotli as the affected product and says different products could use the component.
Why it matters
The flaw that could let a remote attacker join a group chat is tracked as CVE-2026-113961; the Brotli flaw, CVE-2026-111497, is an out-of-bounds write in the library's decoder that could let malicious input corrupt memory.
Response
The updates that fix the iMessage flaws also fix a flaw in Google's Brotli compression library; it is an authorization issue that the updates fix through improved validation.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.