A public iOS sandbox escape called worse_query is raising concern over how much local app data a malicious iPhone app may be able to reach.
The forcequitOS GitHub repository describes worse_query as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2. It also says the code is a developer proof of concept, requires an App Group container and is not a jailbreak.
That last point matters. A jailbreak usually implies broader control over the device. The public worse_query materials describe a narrower but still serious file-access problem: an app can move beyond its expected app container and reach paths that normally belong to other apps or shared app storage.
The repository lists access to application data containers, PluginKit plug-in containers, shared App Group containers and, on iOS 27, certain system data and system group paths. A separate GitHub project called WQ Files says it is built on the worse_query technique and can reach other apps’ and system containers without a jailbreak or kernel exploit.
Technical analysis by Ostorlab describes the issue as involving iOS container management and sandbox-extension handling. In practical terms, the concern is not that worse_query steals data on its own. The concern is that a hostile app using the technique may be able to read files another app assumed were private.
Why Apple’s latest notes do not settle the patch question
Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026. Its advisory lists fixes in AirPlay, App Intents, Bluetooth, brotli, CoreUtils, Messages and rapportd. The separate iOS 26.7.3 and iPadOS 26.7.3 advisory lists eight fixes across a similar set of components. Neither advisory mentions worse_query by name.
The iOS 27.2.1 advisory does include an App Intents issue where an app may be able to access sensitive user data, but Apple does not connect that CVE to worse_query. Treating that entry as a confirmed worse_query fix would go beyond what Apple has published.
Apple’s security documentation also says the company does not disclose, discuss or confirm security issues until an investigation has occurred and patches or releases are available.
As of November 12, 2026, Apple’s security releases page lists iOS 27.2.1 as the latest iOS and iPadOS version. The researcher behind the proof of concept has said that iOS 27.2.1 and iOS 27.3 beta 1 do not patch worse_query.
The crypto wallet risk is serious but conditional
Binance said the flaw affects iOS 26.7.1, iOS 27.0.1 and iOS 27.2, and described it as an iOS-level issue rather than a Binance-specific problem. A Binance spokesperson told crypto.news that the exchange had not identified confirmed cases where attackers used worse_query to access cryptocurrency wallets or steal funds.
The same report also included a key limitation: exposure depends on how each app stores sensitive data. If a wallet stores a seed phrase, private key, keystore file, session token or login credential in a readable local file, a file-access escape becomes more dangerous. If sensitive material is encrypted, hardware-backed or kept outside readable app files, the risk picture changes.
That distinction should prevent two bad conclusions. The first is panic, as public evidence does not show that every iPhone wallet has leaked. The second is complacency, because a public proof of concept can shorten the time between research code and harmful use.
The highest-risk device is one that ran untrusted apps
The strongest short-term risk factor is app provenance. Available descriptions do not show a remote network attack that compromises an iPhone without a local app. They point to a malicious or specially crafted app running on the device.
That makes sideloaded and manually signed apps the clearest exposure path in public reporting. WQ Files release notes say the tool needs a sideloading setup that preserves an App Group entitlement. Binance also specifically told users to delete apps installed from untrusted sources, including sideloaded or manually signed IPA files.
Public reporting has not established whether an App Store-distributed app could use the same technique. For now, the safer reading is narrower: devices that have run untrusted apps deserve closer attention, especially if they also hold crypto wallets, password managers, financial apps or other locally stored secrets.
Practical steps while the patch status is unresolved
Binance and security researchers have pointed to several defensive steps while Apple’s public patch status remains unclear.
Install official iOS updates. The latest Apple updates may not publicly confirm a worse_query fix, but they do close other security flaws.
Remove untrusted apps. Apps installed outside trusted sources, manually signed IPAs and apps from unknown publishers create the clearest risk in current reports.
Review device management profiles. Unknown profiles under VPN and device management settings can indicate app installation paths or device control that should not be there.
Use managed app controls on business devices. Organizations using mobile device management can restrict unmanaged app installation and audit devices that have run software outside the approved catalog.
Treat a suspected wallet exposure as credential exposure. Binance recommended creating a new wallet on a trusted device, moving assets to the new wallet and resetting active login sessions if compromise is suspected.
Removing a suspicious app can reduce future exposure. It cannot prove that files were not read while the app was installed. That is why suspected crypto wallet exposure requires a fresh wallet rather than simply reinstalling the same app or reusing the same recovery phrase.
What to watch next
The clearest resolution would be an Apple advisory or release note that names worse_query, describes a matching sandbox or container fix, or credits the researchers connected to the proof of concept. A CVE assignment would also make tracking easier.
Another signal would be an update to the original GitHub repository’s supported-version list. At the moment, the original repository lists iOS 26.0 through 26.7.2 and iOS 27.2, while later public posts and derivative projects discuss iOS 27.2.1 and iOS 27.3 beta 1. That mismatch is one reason the affected-version range should be treated as unsettled.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
