On an iPhone without Apple’s August update, tapping “Don’t Allow” on the microphone prompt didn’t have to stop an app from listening.
Security researcher Mustafa Calap, who goes by ordinal0, published the details on his blog on 9 November. His test app showed the normal microphone prompt, the user refused, and the app recorded anyway. iOS kept showing the permission as denied. The orange microphone dot never appeared, and the recording carried on with the app in the background and the screen locked.
Apple fixed the flaw, CVE-2026-65339, in iOS and iPadOS 26.6.1 on 17 August and later in its other systems. One question is still open, because Apple’s security notes for iOS 27 don’t mention it.
Source: Privacy Affairs · 2026-11-09