A proof-of-concept called worse_query, posted publicly on GitHub on November 8, escapes the iOS app sandbox. Its README lists iOS 26.0 through 26.7.2 and iOS 27 up to 27.2.
A sandbox escape lets an app reach beyond its own walled-off storage. In practice, one app could read the private files that other apps keep on your iPhone.
On November 10, crypto exchange Binance warned iPhone users that this could expose seed phrases, private keys and logins stored locally by apps. Binance says it has seen no confirmed thefts so far.
What the worse_query sandbox escape does
The repository comes from the developer forcequitOS. It follows an earlier proof-of-concept from the same developer called bad_query, which covered iOS 26.0 to 26.6.1 and the iOS 27.0 beta 4 build.
According to the README, worse_query can reach the folders where iOS keeps each app’s private data. It can also reach the shared App Group containers that apps use to exchange files.
The developer frames it as a tool for other developers and says it isn’t useful on its own. To work, an app needs an App Group container, which any developer can set up. The README also states that it has nothing to do with jailbreaking.
Which iOS versions are affected
The README gives the range as iOS 26.0 to 26.7.2 and iOS 27 up to 27.2. The second figure appears to mark the newest build tested, as it did in the bad_query README.
Binance’s own warning names iOS 26.7.1, 27.0.1 and 27.2. All three fall inside the README’s range.
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, one day after the code went up. As of November 10, Apple has not named worse_query in the security notes for either update. Neither note lists an entry described as a sandbox escape.
That leaves an open question. The README’s range stops at 26.7.2 and 27.2 and doesn’t mention the newer builds either way. So it is unclear whether those updates block it.
What Binance is saying
Binance described worse_query as an iOS-level issue rather than a problem unique to its own app. A Binance spokesperson told crypto.news the warning was based on published technical evidence.
How exposed a given app is depends on how it stores data and how well it encrypts it, the spokesperson said. Binance also confirmed its own iOS app could be affected, along with other apps on vulnerable phones.
“At present, we have not identified any confirmed cases in which attackers used worse_query to access cryptocurrency wallets or steal funds.”
That statement came from a Binance spokesperson speaking to crypto.news. Keep in mind that Binance is a crypto exchange, not an independent security researcher. The warning is its own reading of the published code.
What iPhone owners should do now
Binance’s advice comes down to three steps:
- Remove apps you don’t trust: Binance recommends deleting sideloaded or untrusted apps from your iPhone.
- Update iOS: install updates only through Apple’s official channels.
- Move to a new wallet if you suspect a problem: Binance suggests this if you think your device has been compromised.
Installing iOS 27.2.1 or iOS 26.7.3 is still sensible, even without a confirmed worse_query fix. Both updates carry other security patches. We broke down what’s in the latest release in our post on the iOS 27.2.1 security update.
Sources: worse_query on GitHub, Binance on X, crypto.news, Apple (iOS 27.2.1), Apple (iOS 26.7.3)
