Camera covers do almost nothing, and Apple just gave that argument a fresh test. One patch inside iOS 27.2 closes a hole where a rogue app could reach the lens while the permission dialog sat unanswered. The indicator light still worked. The consent gate did not.
The flaw carried CVE-2026-86990 and a credit for researcher Mustafa Calap. Its home was CoreMedia, the framework Apple hands developers for audio and video. The advisory is thin: an access issue resolved with tighter restrictions. In practice the prompt asking whether an app may film you could be stepped around entirely.
On a Mac that prompt comes from TCC, the transparency and consent system meant to fence the camera off until the owner says yes. A frame that skips TCC is not a hardware compromise. It is a routing failure, harder to notice and easier to repeat.
Why the green dot alone is not enough
The light and the lens share a circuit, a design choice Apple made after the 2008 iSight episode. Because the bug attacked authorization rather than the sensor, the glow still appeared. An indicator only informs whoever is looking at it. A phone face down on a table, or a laptop left at a desk during lunch, broadcasts nothing.
Tools that log activation beat plastic slips. OverSight, Patrick Wardle’s free open-source watcher, names the process behind every camera and microphone session.
Nothing in Apple’s notes points to exploitation against real people, so this is patched-and-move-on rather than urgent. The fix rides in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.1, visionOS 27.2, and iOS 18.7.11 for iPhone XS and XR holdouts.
Then spend two minutes in Settings, under Privacy and Security, in the Camera list. Devices collect grants over years, and some apps are gone.
