Binance warns of public worse_query iOS sandbox escape exposing crypto wallet data; Apple fix for iOS 26/27 unconfirmed
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 11/11/2026 12:22; os links antigos trazem para cá.
Fontes: securityonline.info ↗ securityaffairs.com ↗ bleepingcomputer.com ↗ thehackernews.com ↗
Binance warned on November 10, 2026 that worse_query, a public iOS sandbox escape, lets a malicious app read other apps' local files on iPhones running iOS 26 and iOS 27. That could expose seed phrases, private keys and login credentials. The proof of concept was published on GitHub on November 8, 2026 by the researcher forcequitOS (thehackernews.com). Apple released iOS 27.2.1 and iOS 26.7.3 the next day, but the release notes do not mention worse_query, and no fix is confirmed (thehackernews.com, securityaffairs.com, bleepingcomputer.com). On November 11, securityonline.info also reported that Apple has not yet addressed the flaw in its latest firmware updates, and it calls the issue a zero-day. Neither Binance nor the researcher has reported attacks or thefts, and no cryptocurrency losses are confirmed (bleepingcomputer.com, securityaffairs.com). Exploitation requires a malicious app already on the device, typically a sideloaded one. No CVE has been assigned to worse_query, and the researcher says they will not seek an Apple bug bounty (securityaffairs.com).
Entenda a falha
A vulnerabilidade
worse_query is a public iOS sandbox escape with no CVE. An app that has created an App Group container can read other apps' data containers, shared app-group containers and, on iOS 27, some system paths. That can expose seed phrases, private keys and login credentials. The attacker needs a malicious app already on the device, typically sideloaded. No jailbreak or kernel exploit is needed. The researcher's README lists iOS 26.0 to 26.7.2 and 27.2, while Binance names only 26.7.1, 27.0.1 and 27.2. No fix is confirmed in iOS 27.2.1 or 26.7.3. securityonline.info also says iOS 18.7.12 is still vulnerable, but no other source says so.
Como funciona
Normally iOS confines each app to its own container and the shared spaces it declares. With worse_query, the app first sets up an App Group container. Per Ostorlab's analysis, it then abuses the container manager's sandbox-extension API, running locally inside the app sandbox rather than as a network service. The app ends up able to reach other apps' data containers, shared app-group containers and, on iOS 27, some system folders. The articles do not detail the exact step where the isolation check fails.
Por que é vulnerável
The articles do not give a full root cause. Per Ostorlab, the technique abuses the container manager's sandbox-extension API, so the sandbox's isolation between app containers can be crossed once an app holds an App Group. worse_query is described as the successor to bad_query. Apple has confirmed no fix, so it is unknown what a patch would change.
Onde está
The articles name no file or function; the proof of concept is in the public GitHub repository forcequitOS/worse_query, and Ostorlab points to the container manager's sandbox-extension API.
Como foi descoberta
The researcher forcequitOS published worse_query on GitHub on November 8, 2026. He wrote on X that he had not planned to release it early, but Apple was stalling on responding to him and people started misusing it. The articles do not say when or how he found it. Apple released iOS 27.2.1 and 26.7.3 the next day without mentioning it. Binance warned users on November 10. Neither Binance nor the researcher reports attacks or thefts, and the researcher says he will not seek a bug bounty.
PoC pública
The proof-of-concept code is public on GitHub. The researcher says it is aimed at developers and "isn't useful by itself". Other developers built on it: WQ Files, by Christoph Kolbicz, is a file manager that browses, exports, edits, deletes and clears other apps' data without a jailbreak, and installs via AltStore or SideStore. That makes it a working, easily distributed tool. Because no fix is confirmed, treat it as urgent for devices with crypto wallets or sideloaded apps.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 12:38.
Detalhes técnicos
- worse_query is a proof of concept that succeeds bad_query. It reaches application data containers, shared app-group containers and, on iOS 27, some system paths (thehackernews.com, securityaffairs.com). Per Ostorlab's analysis, it abuses the container manager's sandbox-extension API and runs locally inside the app sandbox, not as a network service (bleepingcomputer.com).
- securityonline.info describes it as letting unprivileged apps escape sandbox protections and access data across app containers and system directories. It does not jailbreak the device, but a malicious app could inspect and exfiltrate cryptographic credentials and personal media (securityonline.info).
- The calling app must first create an App Group container. The researcher describes the code as aimed at developers and 'not useful by itself' (thehackernews.com, securityaffairs.com).
- WQ Files, a file manager by developer Christoph Kolbicz, builds on the technique. It browses, exports, edits, deletes and clears other apps' data without a jailbreak or kernel exploit, and was built and tested on iOS 27.0.1 (bleepingcomputer.com, securityaffairs.com).
- WQ Files installs through sideloading tools such as AltStore and SideStore, which create the App Group automatically when the user signs in with an Apple ID (securityaffairs.com). No party has said whether an App Store app could use the technique (thehackernews.com).
- CVE-2026-113963, an App Intents flaw Apple fixed in iOS 27.2.1 (CVSS v3.1 5.5 per Tenable, cited by bleepingcomputer.com), is a separate issue. No source confirms it is the worse_query escape (bleepingcomputer.com).
Remediação
- Delete apps installed from untrusted sources, such as sideloaded or manually signed apps, including WQ Files and other tools built on worse_query. Update iOS and all apps (thehackernews.com, securityaffairs.com, bleepingcomputer.com).
- Avoid installing unverified apps and be cautious with third-party software sources until a patch is released (securityonline.info).
- If a breach is suspected, move funds to a new wallet created on a clean device and reset all active login sessions, as Binance advises (thehackernews.com, bleepingcomputer.com).
- Avoid storing secrets in plaintext on the device, a precaution SlowMist also advises (bleepingcomputer.com).
- Do not assume iOS 27.2.1 or 26.7.3 closes the issue, because no vendor fix is confirmed.
Relatos divergentes
- Affected versions: Binance's warning, as relayed by securityaffairs.com and bleepingcomputer.com, names iOS 26.7.1, 27.0.1 and 27.2. The proof of concept's README lists iOS 26.0 through 26.7.2 plus 27.2 (thehackernews.com, bleepingcomputer.com). The README is the researcher's primary statement, so the wider range is the more reliable one.
- iOS 27.2.1: thehackernews.com is the only source listing iOS 27.2.1 for the technique, through a README change by the Erosion developers. bleepingcomputer.com reports that SlowMist's security chief says iOS 27.2.1 blocks worse_query. The researcher's response is cut off in the available text and is not reproduced here. securityonline.info (the most recent source, November 11) says Apple has not yet addressed the flaw in its latest firmware updates, which fits Apple's release notes, where no fix is confirmed. The SlowMist claim therefore remains unverified.
- Scope of exploitation: thehackernews.com says no party has confirmed whether App Store apps could use the technique. The other sources describe the risk mainly through sideloaded apps. securityonline.info speaks of 'malicious applications' in general without specifying how they get onto the device.
- Severity and classification: securityonline.info labels worse_query a 'critical zero-day vulnerability'. No other source gives a severity rating, no CVE or CVSS score exists for it, and the other sources describe a public proof of concept that requires a malicious app already on the device.
Linha do tempo
-
Worse_query iOS Sandbox Escape Exposes Crypto Wallets
ler a análise desta fonte ocultar
Security researchers have identified a critical zero-day vulnerability in iOS, dubbed worse_query, which allows unprivileged apps to escape sandbox protections and access sensitive data across app containers and system directories. This flaw does not enable device jailbreak but permits malicious applications to inspect and exfiltrate cryptographic credentials and personal media, posing a significant threat to cryptocurrency users and privacy. Apple has yet to address this vulnerability in its latest firmware updates, leaving many devices at risk. Until a patch is released, users should avoid installing unverified apps and be cautious with third-party software sources.
-
Public iOS sandbox escape 'worse_query' lets apps read other apps' data; Apple has not confirmed a fix
ler a análise desta fonte ocultar
A public proof-of-concept called worse_query, published on GitHub by the researcher forcequitOS, lets one app read the local files of other apps on iOS 26.7.1, 27.0.1 and 27.2. Binance warned users on 10 November that seed phrases, private keys and login credentials could be exposed to a malicious app. Apple released security updates for both iOS branches the day after the PoC appeared, but its release notes do not report a fix for this issue. No CVE is named in the article, and neither Binance nor the researcher has reported attacks or data theft. Criticity is high because a public exploit targets crypto-wallet data and no fix is confirmed, but the attacker needs a malicious app installed on the device, and the PoC needs an App Group container that the app must create.
Technical Details
The PoC can reach the data folders of all apps and, on iOS 27, some system folders. The app running it must first create an App Group container. The researcher describes the code as intended for developers and says it 'isn't useful by itself', yet developers have already built installable apps from it. WQ Files, a file manager by Christoph Kolbicz, reportedly reads, edits, deletes and clears other apps' data without a jailbreak or kernel exploit. Users can install it by sideloading with tools such as AltStore and SideStore, which create the App Group automatically when the user signs in with an Apple ID.
Remediation
Binance advises users to remove apps installed from untrusted sources, to update iOS and all apps to the latest official versions, and, if a breach is suspected, to move funds to a new wallet on a clean device and reset all active login sessions. The researcher says they will not seek an Apple bug bounty.
-
Binance warns of unpatched worse_query iOS sandbox escape that exposes crypto wallet secrets
ler a análise desta fonte ocultar
Binance warned on November 10, 2026 that worse_query, a publicly disclosed iOS sandbox escape, could let a malicious app read other apps' local files, exposing seed phrases, private keys and login credentials. The technique was published as a proof of concept on GitHub by the researcher forcequitOS (github.com/kolbicz/WQFiles), and developer Christoph Kolbicz built the WQ Files file manager on it to browse, edit and delete other apps' data without a jailbreak. Binance names iOS 26.7.1, 27.0.1 and 27.2, while the proof of concept's own list runs from iOS 26.0 to 26.7.2 plus 27.2. No cryptocurrency losses have been confirmed. The attack requires a malicious app already on the device, typically a sideloaded one, but no fix is confirmed: Apple's iOS 27.2.1 and 26.7.3 security notes do not mention worse_query.
Technical Details
- worse_query is a sandbox escape that reaches other apps' data containers, app group containers, extension data and some system locations (github.com/kolbicz/WQFiles). Per Ostorlab's analysis, it abuses the container manager's sandbox-extension API and runs locally inside the app sandbox, not as a network service (blog.ostorlab.co).
- WQ Files browses, exports, edits and deletes other apps' data with no jailbreak and no kernel exploit, and was built and tested on iOS 27.0.1 (github.com/kolbicz/WQFiles). It installs through sideloading tools such as AltStore and SideStore (thehackernews.com).
- The researcher's proof of concept lists iOS 26.0 through 26.7.2 and iOS 27.2 as affected (blog.ostorlab.co), and the iOS 27.2 entry is the only one shared with Binance's list (decrypt.co).
- No CVE has been assigned to worse_query (thecybersecguru.com), and Apple has not published an advisory for it (blog.ostorlab.co).
- The App Intents flaw CVE-2026-113963, which Apple fixed in iOS 27.2.1, is a separate issue; its Tenable record lists CVSS v3.1 5.5 (tenable.com). No source found confirms that it is the worse_query sandbox escape (coincentral.com).
Remediation
- No vendor fix is confirmed for worse_query. Apple's iOS 27.2.1 and 26.7.3 updates are the general measure, but their notes do not mention the escape (thehackernews.com).
- Delete untrusted and sideloaded apps, including WQ Files and other tools built on worse_query, and update iOS and all apps (thehackernews.com).
- Where compromise is suspected, transfer funds to a new wallet created on a clean device and reset all active login sessions, as Binance advises (bleepingcomputer.com).
- Avoid storing secrets in plaintext on the device, a precaution SlowMist also advises (kucoin.com).
Conflicting Reports
- Binance and the article name iOS 26.7.1, 27.0.1 and 27.2 (bleepingcomputer.com). The proof of concept's README lists iOS 26.0 through 26.7.2 and 27.2 (blog.ostorlab.co), so the wider range is the one the researcher publishes.
- SlowMist's security chief says iOS 27.2.1 blocks worse_query (decrypt.co). The researcher states that worse_query is not patched in iOS 27.2.1 or 27.3 beta 1 (thecybersecguru.com). Apple has not confirmed either claim, and the researcher's direct statement is the more specific source.
- The article says the proof of concept was published 'yesterday'. The GitHub repository was created on November 8, 2026 (blog.ostorlab.co), one day before the article's date.
The research found no public commit or pull request for a worse_query fix, so this report has no Fix Details section.
-
Binance warns of worse_query iOS sandbox escape that could expose crypto wallet keys; no Apple fix confirmed
ler a análise desta fonte ocultar
Binance warned users that the public worse_query iOS sandbox escape lets an app read other apps' files on iPhones running iOS 26 and iOS 27, which could expose seed phrases, private keys and login credentials to malicious apps. The proof of concept was published on GitHub on Sunday, November 8, 2026, by the researcher forcequit (forcequitOS), a day before Apple released iOS 27.2.1 and iOS 26.7.3. Apple's notes for those releases do not mention worse_query or any sandbox issue, and no fix has been confirmed (thehackernews.com). Neither the exchange nor the researcher has reported any attacks or thefts, and the code is aimed at developers. Exploitation therefore depends on a malicious app already being installed on the device.
Technical Details
The repository describes worse_query as a proof of concept that succeeds bad_query and reaches application data containers, shared app-group containers and some system paths on iOS 27 (github.com/forcequitOS/worse_query). According to the article, a calling app must first create an App Group container, and the proof of concept is described as not useful on its own (thehackernews.com). WQ Files, a file manager built by developer Christoph Kolbicz, uses the technique without a jailbreak or kernel exploit to read, edit, delete and clear other apps' data, and it installs through sideloading tools such as AltStore and SideStore (thehackernews.com). No party has said whether an App Store app could use the technique (thehackernews.com).
Remediation
Binance advises deleting apps installed from untrusted sources, such as sideloaded or manually signed apps, and updating iOS and every app (thehackernews.com). Users who suspect a breach should move funds to a new wallet created on a clean device and reset all active login sessions (thehackernews.com). Because no fix has been confirmed, the iOS 27.2.1 and 26.7.3 updates should not be assumed to close the issue.
Conflicting Reports
The article describes the researcher's tested range as wider than the three iOS versions in Binance's warning (thehackernews.com). The worse_query README lists iOS 26.0 to 26.7.2 and 27.2 as supported (github.com/forcequitOS/worse_query), so that primary source is used for the version range. The article is the only source listing iOS 27.2.1 for the technique, through the Erosion developers' README change (thehackernews.com).