Researcher Details iOS Microphone Permission Bypass Fixed by Apple

Summary

Researcher Mustafa Calap found an iOS app could alter an audiomxd identity token to record audio after microphone permission was denied, without the orange indicator. Apple patched CVE-2026-65339, but its notes do not clarify whether iOS/iPadOS 27 includes the fix.

Key points

Calap demonstrated that a test app could record microphone audio after the user denied permission; the orange microphone indicator stayed off, including during background recording with the screen locked.
He found an undocumented setting, property 2009, allowed an app to overwrite its stored identity token with the audio service’s token, causing audiomxd to skip the permission check.
The demonstrated method required no jailbreak, memory corruption, or special entitlements. Recording had to begin while the app was on screen; the test apps were installed through Xcode, not reviewed by Apple.
Apple patched CVE-2026-65339 in iOS/iPadOS 26.6.1 and, for older devices, 18.7.11; the article also lists fixes for macOS, watchOS, tvOS, and visionOS.
Calap reproduced the issue on iOS 26.6 and an iPadOS 27 beta. Apple’s notes do not say whether iOS/iPadOS 27 includes the fix, and the article says he had not reported testing a final iOS 27 build.
Apple’s notes do not say the flaw was used in attacks.

Article Details

Vulnerability Types: Microphone permission bypass
Severity: Medium (5.0 out of 10; score assigned by CISA, according to the article)
Affected Versions: iOS 26.6
iPadOS 27 beta
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: available