iOS contains a critical vulnerability—dubbed “worse_query”—that allows malicious apps to break out of their sandbox and access data from other apps. This security flaw affects multiple versions, including iOS 26.7.1, 27.0.1, and 27.2, putting items like login credentials, private keys, and seed phrases at risk.
What Users Need to Know
The issue was raised prominently by Binance, which warned iPhone users that the exploit enables unauthorized apps to view files belonging to other apps. This raises major implications for personal and financial security, especially among cryptocurrency platforms where safeguarding private keys is essential. Binance advised removing any apps not sourced from trusted providers—such as sideloaded apps or those with manually signed IPAs—and updating devices and apps to their latest official versions.
How the Vulnerability Came to Light
The exploit was revealed by researchers known as forcequit and 0xjohnny. They claim Apple has not yet patched “worse_query” despite its existence being known prior to the public disclosure. Apple pushed iOS 27.2.1 and iOS 26.7.3 updates on November 9, but the issue wasn’t addressed in the security content of 27.2.1. A developer beta of iOS 27.3 is already in testing, but it, too, appears to lack a fix.
Responsible disclosure norms—where researchers give companies time to address vulnerabilities—were not fully followed in this case. The public reveal came after Binance sounded the alarm and following internal communication between the researchers and Apple, who reportedly delayed a review that typically takes around seven days.
Practical Steps You Can Take
If you believe any account may have been compromised—particularly a cryptocurrency wallet—Binance recommends transferring funds to a freshly set up wallet on a secure device, resetting all active login sessions, and cleaning up or removing any risky apps.
This problem is distinct from Binance’s recent $6.3 billion crypto breach; the current issue is an iOS-wide risk unrelated to that breach.
Despite Apple’s known beta track for upcoming versions, and the public disclosure, no patch has been officially confirmed. The public and developers alike now seriously expect Apple to move quickly to close this loophole.
Why It Matters: This exploit undermines one of iOS’s key security guarantees: application sandboxing. When apps can access each other’s stored data, the risk of theft—from login data to cryptocurrency seed phrases—skyrockets. Secure isolation between apps has been a structural cornerstone of iOS’s safety model; if this model fails, the potential impact is substantial.
