Overview
- Researcher forcequitOS published the worse_query proof‑of‑concept on November 8 that demonstrates a sandbox escape allowing one app to list and read directories belonging to other iOS apps.
- Apple released iOS 27.2.1 and 26.7.3 on November 9 but its security notes do not explicitly reference worse_query or state that the exact file‑access method is patched.
- Binance issued a public warning on November 10 identifying iOS 26.7.1, 27.0.1 and 27.2 as affected and said recovery phrases, private keys, and login credentials stored in readable files could be exposed.
- The PoC requires an App Group entitlement and actual risk depends on how each wallet stores secrets, so encrypted or hardware‑backed key storage is less likely to be vulnerable than plaintext files.
- Practical steps advised are to remove untrusted or sideloaded apps, update iOS and apps from official sources, and if compromise is suspected create a new wallet on a clean device and move funds to it.