This article may contain affiliate links. Learn more on our Partner Program page.
A publicly available technique bypasses the separation between apps on the iPhone. The cryptocurrency exchange Binance warns of potential access to seed phrases and private keys. According to the researcher behind the technique, the vulnerability remains unpatched even with the current iOS 27.2.1.
Each app on the iPhone runs in its own sandbox and normally cannot access the data of other apps. This is precisely the boundary that worse_query bypasses. Researchers forcequitOS and 0xjohnny published a proof of concept on GitHub on Sunday, November 8th. Binance issued a warning on Tuesday. In between, iOS 27.2.1 and the other system updates of November 9th were released. Apple's security advisories do not mention a fix specifically attributed to worse_query.
Key Facts at a Glance
- worse_query is a sandbox escape: A specially crafted app can read files from other apps without jailbreaking.
- Binance lists iOS 26.7.1, 27.0.1 and 27.2 as affected, while the project page lists iOS 26.0 to 26.7.2 and iOS 27.2.
- According to forcequitOS, neither iOS 27.2.1 nor iOS 27.3 Beta 1 close the vulnerability.
- No cases of exploitation or theft have been reported so far.
- Binance advises deleting apps from unknown sources and updating everything to the latest version.
What Binance specifically fears
The cryptocurrency exchange published its warning on X on November 10th and explicitly did not limit it to its own app:
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.
Three recommendations are also available: Delete apps from untrusted sources, such as those installed via sideloading or as manually signed IPA files. Update iOS and all apps to the latest official versions. Anyone who suspects a data breach should transfer their balance to a new wallet on a clean device and reset all active login sessions.
How worse_query bypasses the sandbox
According to the project page, worse_query accesses the data containers of installed apps, the containers of extensions and internal system services, as well as shared app group storage. iOS 27 adds further system paths. A prerequisite is that the app includes its own app group container. The researchers describe the code as a proof of concept for developers, which, on its own, is ineffective, and emphasize that it is not a jailbreak.
How quickly things can change became clear just one day after the release: Developer Christoph Kolbicz introduced WQ Files, a file manager based on worse_query that displays and edits app data under iOS 27 without jailbreaking, tested on iOS 27.0.1. worse_query is the successor to bad_query, which forcequitOS released in the summer for iOS 26.0 to 26.6.1 and the fourth beta of iOS 27.
Whether a wallet actually exposes keys depends on how it stores them. The security company SlowMist sees a particular risk where a wallet stores seed phrases, keystores, or WebView data unencrypted in its own container. Hardware wallets keep the keys away from the phone anyway.
Which versions are affected?
The figures differ because Binance and the researchers cite different numbers:
| Source | Information on iOS versions |
|---|---|
| Binance warning (November 10th) | Affected: iOS 26.7.1, 27.0.1 and 27.2 |
| Project page of worse_query | Works with: iOS 26.0 to 26.7.2 and iOS 27.2 |
| forcequitOS on X (10.11.) | Not closed: iOS 27.2.1 and iOS 27.3 Beta 1 |
For the current version, forcequitOS has clarified the situation on X:
Just as a general statement so there isn't any confusion about it, worse_query is not patched in iOS 27.2.1 and 27.3 beta 1. I'll update version support on the readme when it's patched.
This also affects the first beta of iOS 27.3, which was released to developers on November 3rd. The head of security at SlowMist had initially stated on the same day that iOS 27.2.1 blocked worse_query; forcequitOS contradicted this with the clarification above.
The security advisories for iOS 27.2.1 do contain an entry regarding app intents, indicating that an app could access sensitive user data. However, this was reported by a different researcher, *worser_query* is not mentioned there, and forcequitOS still considers the vulnerability open. No such entry can be found in the advisories for iOS 26.7.3. There is currently no CVE identifier for *worser_query*.
Why the origin of apps now matters
I consider the situation serious, but not a cause for panic. The attack requires a specially crafted app on the device, and that's precisely where the vulnerability lies. Manually installed enterprise apps only start after they have been explicitly trusted under Settings > General > VPN & Device Management. Checking this section will show whether such apps are present on the device. Anything no longer needed should be uninstalled, as should any other app not from the App Store whose origin is unclear.
In the EU, two additional methods are available: alternative app marketplaces and distribution via websites. Marketplaces have existed since iOS 17.4, and web distribution since iOS 17.5. Anyone who has installed apps from unknown providers via these channels should review the list more critically than usual in the coming days. The other basic rules for protecting against malware on Apple devices remain unchanged.
While the iOS 27.2.1 update doesn't fix the worse_query vulnerability, it's still worthwhile: among other things, it resolves a flaw in iMessage group conversations. Anyone keeping larger sums of money in an iPhone Wallet is better off with a hardware wallet until Apple releases a fix for iOS 27.
Do you have apps from sources other than the App Store on your iPhone, and would you delete them now because of the worse_query warning? Let us know in the comments which sources you use and how you deal with the warning.
