Overview
- A researcher published the worse_query proof-of-concept on GitHub that demonstrates a sandbox escape able to access other apps’ data containers, with the code first posted on November 8.
- Binance issued an official warning on Tuesday, November 10, naming iOS builds 26.7.1, 27.0.1 and 27.2 as tested and urging immediate removal of untrusted or sideloaded apps and prompt updates.
- Apple released iOS 27.2.1 and 26.7.3 on November 9 but its security notes do not explicitly name worse_query or confirm the specific sandbox-escape path is fixed.
- Exploitation requires an App Group entitlement, so the most practical attack vector is through sideloaded or manually signed apps and file-manager apps built on the PoC such as WQ Files.
- No confirmed thefts have been reported so far, but experts stress that wallets storing plain recovery phrases or keys on-device are at highest risk and advise creating a new wallet on a clean device if compromise is suspected.