EN PT-BR
← Voltar ao feed
high cryptocurrency

Binance warns of public worse_query iOS sandbox escape exposing crypto wallet data; Apple fix for iOS 26/27 unconfirmed

3 fonte(s) · 3 atualização(ões) · publicado 10/11/2026 09:15 · coletado há 12 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 11/11/2026 00:00; os links antigos trazem para cá.

Fontes: securityaffairs.com ↗ bleepingcomputer.com ↗ thehackernews.com ↗

Binance warned on November 10, 2026 that worse_query, a public iOS sandbox escape, lets a malicious app read other apps' local files on iPhones running iOS 26 and iOS 27. That could expose seed phrases, private keys and login credentials. The proof of concept was published on GitHub on November 8, 2026 by the researcher forcequitOS (thehackernews.com). Apple released iOS 27.2.1 and iOS 26.7.3 the next day, but the release notes do not mention worse_query, and no fix is confirmed (thehackernews.com, securityaffairs.com, bleepingcomputer.com). Neither Binance nor the researcher has reported attacks or thefts, and no cryptocurrency losses are confirmed (bleepingcomputer.com, securityaffairs.com). Exploitation requires a malicious app already on the device, typically a sideloaded one. No CVE has been assigned to worse_query, and the researcher says they will not seek an Apple bug bounty (securityaffairs.com).

Entenda a falha

A vulnerabilidade

worse_query is an iOS sandbox escape with no CVE assigned. A malicious app already on the device, typically sideloaded, can read other apps' local files, including data containers, shared app-group containers and, on iOS 27, some system paths. That can expose seed phrases, private keys and login credentials. Binance names iOS 26.7.1, 27.0.1 and 27.2, while the researcher's README lists iOS 26.0 to 26.7.2 plus 27.2, the wider and more reliable range. Apple's iOS 27.2.1 and 26.7.3 notes do not mention it, so no fix is confirmed.

Como funciona

The attack runs locally inside the sandbox of an app the victim installed, not as a network service. The app must first create an App Group container. According to Ostorlab, it then abuses the container manager's sandbox-extension API to cross the boundary that normally isolates each app's storage. Once across, it can browse, export, edit, delete and clear other apps' data. The articles give no finer internal steps.

Por que é vulnerável

The articles do not state a precise root cause. They only say the technique abuses the container manager's sandbox-extension API, so the boundary between apps can be crossed without a jailbreak or kernel exploit. worse_query is described as the successor to bad_query. Since no fix is confirmed, nothing is said about what a patch would change.

Onde está

Per Ostorlab, the container manager's sandbox-extension API; the public code is in the researcher's repository github.com/forcequitOS/worse_query. No fixing commit, file or function is named.

Como foi descoberta

The researcher forcequitOS published worse_query on GitHub on November 8, 2026. In a reply on X he said he had not planned to release it early, and that Apple was stalling on responding to him and people started larping with it. That suggests Apple had been contacted, but the articles do not say how the flaw was found or when it was reported. Binance warned on November 10. Neither Binance nor the researcher reports attacks or thefts. He says he will not seek an Apple bug bounty. On iOS 27.2.1, SlowMist's security chief says it blocks worse_query, while Erosion's developers only wrote 'pretty sure 27.2.1 is supported'. Apple confirms neither. CVE-2026-113963, reported by László Várady via App Intents, is not confirmed to be the same issue.

PoC pública

The proof of concept is public on GitHub from forcequitOS. The researcher says the code is for developers and not useful by itself. Developer Christoph Kolbicz built the WQ Files file manager on it. It browses, exports, edits, deletes and clears other apps' data without a jailbreak or kernel exploit, and was tested on iOS 26.7.1, 27.0.1 and 27.2. It installs through sideloading tools such as AltStore and SideStore, which create the App Group automatically. Since a working tool is public and no fix is confirmed, treat it as urgent: remove sideloaded and untrusted apps and keep iOS updated.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:16.

Detalhes técnicos

  • worse_query is a proof of concept that succeeds bad_query. It reaches application data containers, shared app-group containers and, on iOS 27, some system paths (thehackernews.com, securityaffairs.com). Per Ostorlab's analysis, it abuses the container manager's sandbox-extension API and runs locally inside the app sandbox, not as a network service (bleepingcomputer.com).
  • The calling app must first create an App Group container. The researcher describes the code as aimed at developers and 'not useful by itself' (thehackernews.com, securityaffairs.com).
  • WQ Files, a file manager by developer Christoph Kolbicz, builds on the technique. It browses, exports, edits, deletes and clears other apps' data without a jailbreak or kernel exploit, and was built and tested on iOS 27.0.1 (bleepingcomputer.com, securityaffairs.com).
  • WQ Files installs through sideloading tools such as AltStore and SideStore, which create the App Group automatically when the user signs in with an Apple ID (securityaffairs.com). No party has said whether an App Store app could use the technique (thehackernews.com).
  • CVE-2026-113963, an App Intents flaw Apple fixed in iOS 27.2.1 (CVSS v3.1 5.5 per Tenable, cited by bleepingcomputer.com), is a separate issue. No source confirms it is the worse_query escape (bleepingcomputer.com).

Remediação

  • Delete apps installed from untrusted sources, such as sideloaded or manually signed apps, including WQ Files and other tools built on worse_query. Update iOS and all apps (thehackernews.com, securityaffairs.com, bleepingcomputer.com).
  • If a breach is suspected, move funds to a new wallet created on a clean device and reset all active login sessions, as Binance advises (thehackernews.com, bleepingcomputer.com).
  • Avoid storing secrets in plaintext on the device, a precaution SlowMist also advises (bleepingcomputer.com).
  • Do not assume iOS 27.2.1 or 26.7.3 closes the issue, because no vendor fix is confirmed.

Relatos divergentes

  • Affected versions: Binance's warning, as relayed by securityaffairs.com and bleepingcomputer.com, names iOS 26.7.1, 27.0.1 and 27.2. The proof of concept's README lists iOS 26.0 through 26.7.2 plus 27.2 (thehackernews.com, bleepingcomputer.com). The README is the researcher's primary statement, so the wider range is the more reliable one.
  • iOS 27.2.1: thehackernews.com is the only source listing iOS 27.2.1 for the technique, through a README change by the Erosion developers. bleepingcomputer.com reports that SlowMist's security chief says iOS 27.2.1 blocks worse_query. The researcher's response is cut off in the available text and is not reproduced here. Apple's notes confirm no fix, so the claim is unverified.
  • Scope of exploitation: thehackernews.com says no party has confirmed whether App Store apps could use the technique. The other sources describe the risk mainly through sideloaded apps.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 10/11/2026 12:46 · coletado 10/11 13:03

    Public iOS sandbox escape 'worse_query' lets apps read other apps' data; Apple has not confirmed a fix

    ler a análise desta fonte

    A public proof-of-concept called worse_query, published on GitHub by the researcher forcequitOS, lets one app read the local files of other apps on iOS 26.7.1, 27.0.1 and 27.2. Binance warned users on 10 November that seed phrases, private keys and login credentials could be exposed to a malicious app. Apple released security updates for both iOS branches the day after the PoC appeared, but its release notes do not report a fix for this issue. No CVE is named in the article, and neither Binance nor the researcher has reported attacks or data theft. Criticity is high because a public exploit targets crypto-wallet data and no fix is confirmed, but the attacker needs a malicious app installed on the device, and the PoC needs an App Group container that the app must create.

    Technical Details

    The PoC can reach the data folders of all apps and, on iOS 27, some system folders. The app running it must first create an App Group container. The researcher describes the code as intended for developers and says it 'isn't useful by itself', yet developers have already built installable apps from it. WQ Files, a file manager by Christoph Kolbicz, reportedly reads, edits, deletes and clears other apps' data without a jailbreak or kernel exploit. Users can install it by sideloading with tools such as AltStore and SideStore, which create the App Group automatically when the user signs in with an Apple ID.

    Remediation

    Binance advises users to remove apps installed from untrusted sources, to update iOS and all apps to the latest official versions, and, if a breach is suspected, to move funds to a new wallet on a clean device and reset all active login sessions. The researcher says they will not seek an Apple bug bounty.

  2. bleepingcomputer.com ↗ · pub. 10/11/2026 12:59 · coletado 10/11 13:03

    Binance warns of unpatched worse_query iOS sandbox escape that exposes crypto wallet secrets

    ler a análise desta fonte

    Binance warned on November 10, 2026 that worse_query, a publicly disclosed iOS sandbox escape, could let a malicious app read other apps' local files, exposing seed phrases, private keys and login credentials. The technique was published as a proof of concept on GitHub by the researcher forcequitOS (github.com/kolbicz/WQFiles), and developer Christoph Kolbicz built the WQ Files file manager on it to browse, edit and delete other apps' data without a jailbreak. Binance names iOS 26.7.1, 27.0.1 and 27.2, while the proof of concept's own list runs from iOS 26.0 to 26.7.2 plus 27.2. No cryptocurrency losses have been confirmed. The attack requires a malicious app already on the device, typically a sideloaded one, but no fix is confirmed: Apple's iOS 27.2.1 and 26.7.3 security notes do not mention worse_query.

    Technical Details

    • worse_query is a sandbox escape that reaches other apps' data containers, app group containers, extension data and some system locations (github.com/kolbicz/WQFiles). Per Ostorlab's analysis, it abuses the container manager's sandbox-extension API and runs locally inside the app sandbox, not as a network service (blog.ostorlab.co).
    • WQ Files browses, exports, edits and deletes other apps' data with no jailbreak and no kernel exploit, and was built and tested on iOS 27.0.1 (github.com/kolbicz/WQFiles). It installs through sideloading tools such as AltStore and SideStore (thehackernews.com).
    • The researcher's proof of concept lists iOS 26.0 through 26.7.2 and iOS 27.2 as affected (blog.ostorlab.co), and the iOS 27.2 entry is the only one shared with Binance's list (decrypt.co).
    • No CVE has been assigned to worse_query (thecybersecguru.com), and Apple has not published an advisory for it (blog.ostorlab.co).
    • The App Intents flaw CVE-2026-113963, which Apple fixed in iOS 27.2.1, is a separate issue; its Tenable record lists CVSS v3.1 5.5 (tenable.com). No source found confirms that it is the worse_query sandbox escape (coincentral.com).

    Remediation

    • No vendor fix is confirmed for worse_query. Apple's iOS 27.2.1 and 26.7.3 updates are the general measure, but their notes do not mention the escape (thehackernews.com).
    • Delete untrusted and sideloaded apps, including WQ Files and other tools built on worse_query, and update iOS and all apps (thehackernews.com).
    • Where compromise is suspected, transfer funds to a new wallet created on a clean device and reset all active login sessions, as Binance advises (bleepingcomputer.com).
    • Avoid storing secrets in plaintext on the device, a precaution SlowMist also advises (kucoin.com).

    Conflicting Reports

    • Binance and the article name iOS 26.7.1, 27.0.1 and 27.2 (bleepingcomputer.com). The proof of concept's README lists iOS 26.0 through 26.7.2 and 27.2 (blog.ostorlab.co), so the wider range is the one the researcher publishes.
    • SlowMist's security chief says iOS 27.2.1 blocks worse_query (decrypt.co). The researcher states that worse_query is not patched in iOS 27.2.1 or 27.3 beta 1 (thecybersecguru.com). Apple has not confirmed either claim, and the researcher's direct statement is the more specific source.
    • The article says the proof of concept was published 'yesterday'. The GitHub repository was created on November 8, 2026 (blog.ostorlab.co), one day before the article's date.

    The research found no public commit or pull request for a worse_query fix, so this report has no Fix Details section.

  3. thehackernews.com ↗ · pub. 10/11/2026 09:15 · coletado 10/11 10:00 primeiro registro

    Binance warns of worse_query iOS sandbox escape that could expose crypto wallet keys; no Apple fix confirmed

    ler a análise desta fonte

    Binance warned users that the public worse_query iOS sandbox escape lets an app read other apps' files on iPhones running iOS 26 and iOS 27, which could expose seed phrases, private keys and login credentials to malicious apps. The proof of concept was published on GitHub on Sunday, November 8, 2026, by the researcher forcequit (forcequitOS), a day before Apple released iOS 27.2.1 and iOS 26.7.3. Apple's notes for those releases do not mention worse_query or any sandbox issue, and no fix has been confirmed (thehackernews.com). Neither the exchange nor the researcher has reported any attacks or thefts, and the code is aimed at developers. Exploitation therefore depends on a malicious app already being installed on the device.

    Technical Details

    The repository describes worse_query as a proof of concept that succeeds bad_query and reaches application data containers, shared app-group containers and some system paths on iOS 27 (github.com/forcequitOS/worse_query). According to the article, a calling app must first create an App Group container, and the proof of concept is described as not useful on its own (thehackernews.com). WQ Files, a file manager built by developer Christoph Kolbicz, uses the technique without a jailbreak or kernel exploit to read, edit, delete and clear other apps' data, and it installs through sideloading tools such as AltStore and SideStore (thehackernews.com). No party has said whether an App Store app could use the technique (thehackernews.com).

    Remediation

    Binance advises deleting apps installed from untrusted sources, such as sideloaded or manually signed apps, and updating iOS and every app (thehackernews.com). Users who suspect a breach should move funds to a new wallet created on a clean device and reset all active login sessions (thehackernews.com). Because no fix has been confirmed, the iOS 27.2.1 and 26.7.3 updates should not be assumed to close the issue.

    Conflicting Reports

    The article describes the researcher's tested range as wider than the three iOS versions in Binance's warning (thehackernews.com). The worse_query README lists iOS 26.0 to 26.7.2 and 27.2 as supported (github.com/forcequitOS/worse_query), so that primary source is used for the version range. The article is the only source listing iOS 27.2.1 for the technique, through the Erosion developers' README change (thehackernews.com).