Overview
- A researcher using the name forcequitOS published a proof-of-concept called worse_query on November 8 that demonstrates a sandbox escape able to read other apps’ files on iOS 26 and 27.
- Apple released iOS updates on November 9 (including 27.2.1 and 26.7.3) but its security notes do not explicitly name worse_query or confirm the technique is fixed.
- On November 10 Binance warned that worse_query could expose seed phrases, private keys and login credentials for devices running iOS 26.7.1, 27.0.1 and 27.2 and urged users to remove untrusted apps, update iOS, and recreate wallets on clean devices if compromise is suspected.
- Third-party developers have already built tools such as WQ Files from the public proof-of-concept and the exploit requires an App Group container so sideloaded or manually signed apps are the primary practical attack vector.
- No confirmed crypto thefts have been publicly tied to worse_query so far and actual risk depends on how each wallet stores secrets, with hardware wallets and Secure Enclave protections offering much stronger safety than plain files.