iOS 27.2.1 leaves reported crypto wallet flaw unpatched

In a November 10 post on X, forcequitOS said worse_query remained active in iOS 27.2.1 and the first beta of iOS 27.3. Apple released the update on November 9, one day after the researcher published the exploit’s source code on GitHub. Apple’s security notes do not list worse_query among the fixes.

The GitHub project says the vulnerability affects iOS versions 26.0 through 26.7.2 and iOS 27.2. It targets the app sandbox, which is designed to limit each application’s access to its own files. The published proof of concept shows a way to reach data containers belonging to other apps, including shared App Groups and certain system directories. The researcher described the original code as a developer tool requiring additional setup; another developer, Christoph Kolbicz, created WQ Files to browse, export, modify or delete other apps’ files without jailbreaking an iPhone.

Apple’s advisory lists nine fixes affecting AirPlay, Bluetooth, Messages, App Intents, Brotli, CoreUtils and rapportd. They include CVE-2026-113963, an App Intents authorization flaw that Apple said it fixed through improved state management, as well as Messages vulnerabilities and a Brotli memory-corruption issue. Apple made the update available for iPhone 11 and newer models, alongside supported iPads.

Binance warned on November 10 that malicious apps could expose locally stored information, including wallet seed phrases, private keys and login credentials. The exchange said it had found no confirmed cryptocurrency theft linked to worse_query. It urged users to remove apps from untrusted sources, including sideloaded or manually signed IPA files, and install official updates. Users who suspect compromise were advised to move assets to a new wallet created on a clean device and reset active login sessions. The exploit requires an app configured with an App Group container; ordinary website browsing does not by itself trigger it.