A researcher known as forcequit published worse_query, an iOS sandbox-escape proof of concept, on GitHub on November 8; it lets an app read other apps' data containers on iOS 26 and 27 [1][2]. Binance warned on November 10 that the issue could let malicious apps obtain seed phrases, private keys and login credentials and is not unique to Binance, though neither the exchange nor the researcher reported any attacks or thefts [1]. Apple's security notes for iOS 27.2.1 and 26.7.3, released November 9, do not mention worse_query and no fix has been confirmed; users should remove apps from untrusted sources and update iOS and all apps [1][3].
MediumMonitoringResearcher reported
Researcher publishes worse_query, an iOS 26/27 sandbox escape that reads other apps' data; Apple's latest update notes list no fix
1 min read
- Disclosed
- Nov 8, 2026
- Occurred
- Nov 8, 2026
- Published
- Nov 10, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- Exploitation and patch status
- No patch
- Attack vector
- Impact
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: Apple iOS
What to do nowOur advice
- Delete apps installed from untrusted sources (sideloaded or manually signed) [1].
- Update iOS and all apps to the latest versions and watch for an Apple fix .
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Apple iOS | 26.0–26.7.2；27.2[2] | — | ✗ Unpatched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
References
Official / primary1
- [3]
“For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available.”
Research2
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.