Public iOS sandbox escape 'worse_query' lets apps read other apps' data; Apple has not confirmed a fix
A public proof-of-concept called worse_query, published on GitHub by the researcher forcequitOS, lets one app read the local files of other apps on iOS 26.7.1, 27.0.1 and 27.2. Binance warned users on 10 November that seed phrases, private keys and login credentials could be exposed to a malicious app. Apple released security updates for both iOS branches the day after the PoC appeared, but its release notes do not report a fix for this issue. No CVE is named in the article, and neither Binance nor the researcher has reported attacks or data theft. Criticity is high because a public exploit targets crypto-wallet data and no fix is confirmed, but the attacker needs a malicious app installed on the device, and the PoC needs an App Group container that the app must create.
Detalhes técnicos
The PoC can reach the data folders of all apps and, on iOS 27, some system folders. The app running it must first create an App Group container. The researcher describes the code as intended for developers and says it 'isn't useful by itself', yet developers have already built installable apps from it. WQ Files, a file manager by Christoph Kolbicz, reportedly reads, edits, deletes and clears other apps' data without a jailbreak or kernel exploit. Users can install it by sideloading with tools such as AltStore and SideStore, which create the App Group automatically when the user signs in with an Apple ID.
Remediação
Binance advises users to remove apps installed from untrusted sources, to update iOS and all apps to the latest official versions, and, if a breach is suspected, to move funds to a new wallet on a clean device and reset all active login sessions. The researcher says they will not seek an Apple bug bounty.
Linha do tempo
-
Public iOS sandbox escape 'worse_query' lets apps read other apps' data; Apple has not confirmed a fix
ler a análise desta fonte ocultar
A public proof-of-concept called worse_query, published on GitHub by the researcher forcequitOS, lets one app read the local files of other apps on iOS 26.7.1, 27.0.1 and 27.2. Binance warned users on 10 November that seed phrases, private keys and login credentials could be exposed to a malicious app. Apple released security updates for both iOS branches the day after the PoC appeared, but its release notes do not report a fix for this issue. No CVE is named in the article, and neither Binance nor the researcher has reported attacks or data theft. Criticity is high because a public exploit targets crypto-wallet data and no fix is confirmed, but the attacker needs a malicious app installed on the device, and the PoC needs an App Group container that the app must create.
Technical Details
The PoC can reach the data folders of all apps and, on iOS 27, some system folders. The app running it must first create an App Group container. The researcher describes the code as intended for developers and says it 'isn't useful by itself', yet developers have already built installable apps from it. WQ Files, a file manager by Christoph Kolbicz, reportedly reads, edits, deletes and clears other apps' data without a jailbreak or kernel exploit. Users can install it by sideloading with tools such as AltStore and SideStore, which create the App Group automatically when the user signs in with an Apple ID.
Remediation
Binance advises users to remove apps installed from untrusted sources, to update iOS and all apps to the latest official versions, and, if a breach is suspected, to move funds to a new wallet on a clean device and reset all active login sessions. The researcher says they will not seek an Apple bug bounty.