worse_query iOS Sandbox Escape Exposes Crypto Wallets
Security researchers recently uncovered a serious zero-day vulnerability threatening mobile operating environments. Specifically, the unpatched worse_query iOS sandbox escape flaw bypasses essential filesystem isolation boundaries. While the exploit does not facilitate a complete device jailbreak, it allows malicious programs to breach sandboxed containers. Consequently, rogue software can traverse protected storage partitions and inspect external application data. Furthermore, attackers can exfiltrate sensitive cryptocurrency assets and personal media archives without user permission.
Under normal operation, the iOS runtime enforces strict sandboxing to isolate third-party applications. Every software package accesses only its dedicated container and declared shared spaces. However, the worse_query exploit traverses shared app groups, localized caches, and sensitive system directories. Therefore, an unprivileged application can inspect confidential records maintained by adjacent programs.
Entenda a falha
A vulnerabilidade
A zero-day sandbox escape in iOS, dubbed worse_query, no CVE assigned. It bypasses filesystem isolation so a malicious app can read data outside its own container, though it is not a full jailbreak. The attacker needs to get an unprivileged app installed on the device. The articles say iOS 27.2.1, 26.7.3 and 18.7.12 are all still vulnerable and no fix exists.
Como funciona
Normally iOS sandboxing lets each app reach only its own container and the shared spaces it declares. According to the article, the worse_query exploit lets an app traverse shared app groups, local caches and sensitive system directories that should be off limits. Through this, an unprivileged app can inspect records kept by other apps. The articles do not detail the exact step where the isolation check fails.
Por que é vulnerável
The articles do not explain the root cause. They only say the flaw defeats the filesystem isolation boundaries of the iOS sandbox, and that Apple has not fixed it in its latest maintenance updates.
Como foi descoberta
The article says only that security researchers recently uncovered the flaw. It does not name them, say how it was found or whether Apple was notified. It describes the bug as an active, unpatched zero-day.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The article calls it an exploit and says it works against current iOS builds, but it does not say who holds it, whether code was published, or give any link. No public PoC can be confirmed from the input. Since there is no patch, treat the risk as urgent for sensitive apps, especially crypto wallets that store seed phrases or keys unencrypted.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 05:15.
Linha do tempo
-
worse_query iOS Sandbox Escape Exposes Crypto Wallets
ler a análise desta fonte ocultar
Security researchers recently uncovered a serious zero-day vulnerability threatening mobile operating environments. Specifically, the unpatched worse_query iOS sandbox escape flaw bypasses essential filesystem isolation boundaries. While the exploit does not facilitate a complete device jailbreak, it allows malicious programs to breach sandboxed containers. Consequently, rogue software can traverse protected storage partitions and inspect external application data. Furthermore, attackers can exfiltrate sensitive cryptocurrency assets and personal media archives without user permission.
Under normal operation, the iOS runtime enforces strict sandboxing to isolate third-party applications. Every software package accesses only its dedicated container and declared shared spaces. However, the worse_query exploit traverses shared app groups, localized caches, and sensitive system directories. Therefore, an unprivileged application can inspect confidential records maintained by adjacent programs.