Apple’s latest iOS 27.2.1 security update reportedly leaves a vulnerability known as worse_query unpatched, raising concerns that malicious applications could still access sensitive data stored by other apps, including cryptocurrency wallet information.
The update addresses nine separate security flaws, but Apple’s official release notes do not mention worse_query.
The researcher who disclosed the exploit said the vulnerability remains active in both iOS 27.2.1 and the first beta of iOS 27.3.
For crypto users, the main concern is that a malicious app could potentially bypass Apple’s normal sandbox protections and access wallet-related files containing sensitive credentials.
Researcher says worse_query is still active
The researcher behind worse_query, known as forcequitOS, said on November 10 that Apple’s latest update had not fixed the issue.
According to the researcher, the vulnerability remains present in iOS 27.2.1 and iOS 27.3 beta 1.
The statement came after confusion over whether Apple’s latest security release had quietly resolved the flaw.
The researcher said the project’s documentation would be updated once Apple releases a confirmed fix.
Apple released iOS 27.2.1 after exploit code became public
Apple released iOS 27.2.1 on November 9.
That came one day after forcequitOS published source code related to the exploit on GitHub.
The public release of exploit code can increase security concerns because other developers can study how the vulnerability works.
Apple’s security notes for iOS 27.2.1 list fixes for several components, but worse_query is not among them.
What is worse_query?
Worse_query is a vulnerability targeting Apple’s application sandbox.
The sandbox is designed to prevent one application from accessing files and data belonging to another.
Under normal conditions, an app should only be able to read information stored inside its own authorized containers.
Worse_query reportedly allows an application to bypass some of those restrictions and reach data associated with unrelated apps.
That creates obvious concerns when those apps store sensitive financial or authentication information.
Crypto wallets could be particularly sensitive
Cryptocurrency wallets often contain information that needs extremely strong protection.
Depending on how a wallet is designed, locally stored data could include:
- Private keys
- Wallet recovery phrases
- Login credentials
- Authentication tokens
- Wallet configuration files
If a malicious application gains unauthorized access to that information, an attacker could potentially gain control over the associated crypto assets.
However, not every wallet stores sensitive information in the same way.
The vulnerability affects multiple iOS versions
According to the researcher’s GitHub documentation, worse_query affects several versions of iOS 26 and iOS 27.
The repository identifies affected releases from iOS 26.0 through 26.7.2 as well as iOS 27.2.
The researcher has also said the flaw remains present in iOS 27.2.1 and the first beta of iOS 27.3.
This means installing the latest public update may not be enough to remove the specific worse_query risk.
Worse_query follows an earlier vulnerability
The researcher describes worse_query as a successor to an earlier issue known as bad_query.
Both vulnerabilities focus on weaknesses in how applications can interact with data containers.
The newer exploit reportedly expands on that earlier approach.
This kind of sandbox bypass is serious because iOS relies heavily on isolation between applications as a core security feature.
Proof of concept shows access to other app containers
The published proof of concept demonstrates how an application can access data containers belonging to other apps.
That includes shared application groups and some system directories.
The original code was described as a developer-oriented tool rather than a fully packaged attack.
However, other developers have reportedly built applications capable of using the technique more directly.
WQ Files demonstrates the capability
One example is an application called WQ Files.
The tool, developed by Christoph Kolbicz, reportedly allows users to browse files belonging to other applications without jailbreaking an iPhone.
It can also export, modify and delete files.
That demonstrates why the vulnerability could be dangerous if incorporated into a malicious app.
The technical capability extends beyond simply viewing harmless application data.
Apple patched nine other security flaws
Although worse_query appears to remain unresolved, iOS 27.2.1 includes fixes for nine other vulnerabilities.
Apple’s advisory lists issues involving:
- AirPlay
- Bluetooth
- Messages
- App Intents
- Brotli
- CoreUtils
- rapportd
The update therefore still contains important security improvements.
Users should not avoid updating simply because one reported vulnerability remains unresolved.
App Intents flaw could expose sensitive information
One of the vulnerabilities fixed in the update is CVE-2026-113963.
Apple described it as an authorization issue involving App Intents.
The flaw could allow applications to gain access to sensitive user information.
Apple said it addressed the vulnerability through improved state management.
Security researcher László Várady was credited with discovering the issue.
App Intents flaw is separate from worse_query
Although both vulnerabilities involve unauthorized access to sensitive information, they affect different parts of iOS.
Apple’s App Intents fix does not appear to address the App Group and sandbox mechanism involved in worse_query.
That distinction is important because users might otherwise assume that any security fix involving unauthorized access also resolves worse_query.
The researcher says that is not the case.
Messages vulnerabilities were also fixed
Apple patched two security issues affecting Messages.
One flaw could reportedly allow a remote attacker to join an iMessage group conversation without proper authorization.
That could allow the attacker to receive messages sent to the group.
Another vulnerability could allow newly added participants to access messages that were sent before they joined.
Both issues were addressed in the update.
Bluetooth and Brotli also received fixes
The release also includes security patches for Bluetooth.
Bluetooth vulnerabilities can create risks around unauthorized connections or device communication.
Apple also fixed a memory corruption issue involving Brotli.
That flaw could be triggered through specially crafted input.
The update therefore remains important even though worse_query appears unresolved.
Binance warns crypto users about the vulnerability
Binance issued a warning on November 10 about the worse_query vulnerability.
The exchange identified several affected iOS versions and said malicious apps could potentially access data stored by other applications.
For crypto users, Binance highlighted the possibility of exposure involving wallet seed phrases, private keys and login credentials.
The warning does not mean confirmed crypto theft has occurred through the exploit.
Binance says no confirmed theft has been identified
A Binance spokesperson said the exchange had not identified any confirmed cryptocurrency theft directly linked to worse_query.
That is an important distinction.
The vulnerability creates a potential attack path.
It does not prove that attackers have already used it to steal crypto from users.
Still, security teams are treating the issue seriously because of the sensitivity of the data that may be accessible.
Sideloaded apps create the biggest immediate concern
Binance advised users to remove applications installed from untrusted sources.
That includes sideloaded applications and manually signed IPA files.
The risk is especially relevant because exploiting worse_query requires a malicious application to run on the device.
Ordinary website browsing alone is not described as sufficient to trigger the exploit.
This makes application installation behavior particularly important.
The exploit requires an application with specific configuration
According to the available technical details, the exploit requires an application configured with an App Group container.
That means an attacker cannot simply exploit the device remotely through a normal web page under the described technique.
The user generally needs to install or run an application capable of using the vulnerability.
This does not eliminate the risk, but it narrows the attack surface.
Crypto users should update devices anyway
Even though worse_query reportedly remains unpatched, users should still install Apple’s latest security update.
iOS 27.2.1 fixes several other vulnerabilities.
Remaining on an older version would expose the device to both worse_query and additional issues that Apple has already addressed.
The safer approach is to stay updated while also avoiding untrusted applications.
Binance recommends reviewing installed applications
Users concerned about the issue should review what is installed on their devices.
Particular attention should be paid to apps that were:
- Sideloaded
- Manually signed
- Downloaded outside normal trusted channels
- Installed from unknown developers
- Shared through unofficial links
Removing unnecessary or suspicious apps can reduce the chance that malicious software is present.
Suspected wallet compromise requires a stronger response
If a user believes their wallet credentials may already have been exposed, simply deleting the suspicious application may not be enough.
A copied seed phrase or private key remains usable even after the malicious app is removed.
An attacker who already obtained the credential could still access the wallet later.
In that situation, the safer response is to move the assets to a wallet controlled by entirely new credentials.
Binance recommends creating a new wallet on a clean device
For users who suspect compromise, Binance recommended moving assets to a new wallet created on a clean device.
That means generating a new recovery phrase or private key rather than reusing the old wallet.
If the old credentials were exposed, restoring the same wallet on a different phone does not solve the problem.
Anyone holding the stolen credentials would still have access.
Users should also reset active sessions
Binance also recommended resetting active login sessions.
This can be important if a malicious application obtained exchange credentials or authentication data rather than only wallet keys.
Users may also want to:
- Change passwords
- Revoke old sessions
- Reset API keys
- Review connected devices
- Reconfigure two-factor authentication
The correct response depends on what information may have been exposed.
Hardware wallets can reduce some mobile-wallet risk
Crypto users who hold significant amounts of digital assets may consider separating signing keys from their everyday smartphone.
Hardware wallets generally keep private keys inside a dedicated device.
That can reduce the risk that a compromised phone application directly accesses the signing key.
However, users still need to protect recovery phrases and avoid entering them into untrusted software.
A hardware wallet cannot protect a seed phrase that the user voluntarily types into a malicious app.
Wallet architecture matters
Not every crypto wallet is equally exposed to a sandbox vulnerability.
Some wallets may store encrypted key material locally.
Others may use hardware-backed security, secure enclaves, external signing devices or different custody models.
This means the actual risk can vary significantly between wallets.
Users should check their wallet provider’s own security guidance rather than assuming every application is affected in exactly the same way.
Exchange accounts face a different risk profile
Assets held on a centralized exchange are not normally controlled by private keys stored inside the user’s iPhone wallet application.
Instead, the exchange manages custody.
However, local account credentials, authentication tokens or session information could still be sensitive.
A compromised device can therefore still create account-security risks even when the user does not self-custody crypto.
Apple has not publicly listed worse_query as fixed
Apple’s official iOS 27.2.1 security documentation does not name worse_query.
That aligns with the researcher’s claim that the flaw remains active.
Users should therefore avoid interpreting the latest update as a confirmed fix for this specific vulnerability.
A future Apple security advisory may clarify when the issue has actually been patched.
iOS 27.3 beta reportedly remains affected
The researcher also said the first beta of iOS 27.3 remains vulnerable.
This suggests the fix is not yet included in the next major point release currently being tested.
However, beta software can change before its final public release.
Apple could still introduce a patch in a later beta or final version.
What users should watch next
The most important development will be an official Apple update confirming that the underlying sandbox flaw has been fixed.
Users should watch for:
- New iOS security releases
- Updated Apple security advisories
- Researcher confirmation
- Wallet provider security notices
- Exchange security guidance
Users should rely on confirmed patches rather than assuming a version number means the issue has been resolved.
Practical steps for crypto users
Until a confirmed fix is available, crypto users can reduce their exposure by following several basic precautions.
Keep iOS updated.
Avoid sideloaded or unofficial applications.
Do not store seed phrases in ordinary notes, screenshots or other easily accessible files.
Use hardware wallets for significant holdings where appropriate.
Keep exchange accounts protected with strong authentication.
And if credentials may already have been exposed, create new wallet keys rather than trusting the old ones.
Final thoughts
Apple’s iOS 27.2.1 update fixes nine security vulnerabilities, but worse_query reportedly remains unresolved.
The issue is particularly important for crypto users because a malicious application could potentially bypass iOS sandbox protections and access sensitive data belonging to wallet apps.
There is currently no confirmed evidence that the vulnerability has been used to steal cryptocurrency.
However, the potential consequences of exposing seed phrases or private keys make the risk significant.
Users should continue installing Apple’s security updates while avoiding untrusted applications.
If wallet credentials may already have been compromised, the safest approach is to move funds to a new wallet generated on a clean device.
Until Apple releases a confirmed patch, application hygiene and careful key management remain the most important defenses.
