Overview
- The proof‑of‑concept for worse_query was published on Sunday, Nov. 8 by researchers including forcequitOS and 0xjohnny and shows a sandbox escape that can read other apps' files.
- Apple released iOS 27.2.1 and 26.7.3 on Nov. 9 but its security notes do not name worse_query, and researchers and security firms disagree over whether those updates fix the issue.
- The exploit depends on an app having an App Group container entitlement, which typically requires installing a manually signed or sideloaded app, and developers have built tools such as WQ Files that demonstrate browsing, exporting, editing, and deleting other apps' data without a jailbreak.
- Binance on Tuesday urged users to delete untrusted or sideloaded apps, update iOS and installed apps, and, if compromise is suspected, create a new wallet on a clean device and transfer funds, while noting there are no confirmed thefts tied to worse_query so far.
- Exposure depends on how wallets store secrets: apps that write seed phrases or keys to readable local files are at higher risk, hardware‑backed stores and hardware wallets keep keys off the phone, and the disclosure could drive tighter device hygiene and demand for safer storage practices.