Apple iOS 27.2.1 Leaves Crypto Wallet Sandbox Flaw Unpatched

By Nathan Brooks

Apple’s iOS 27.2.1, released November 9, fixed nine security vulnerabilities but left the worse_query sandbox-bypass flaw unpatched, according to a November 10 statement from forcequitOS, the researcher behind the exploit, preserving a route for malicious apps to reach cryptocurrency wallet data stored by other apps.

The researcher said worse_query was “not patched in iOS 27.2.1 and 27.3 beta 1” and promised to update the project’s documentation once Apple released a working fix. Apple shipped 27.2.1 one day after forcequitOS published the exploit’s source code on GitHub. The company’s security notes do not mention worse_query among the listed repairs.

The GitHub repository says the flaw affects iOS 26.0 through 26.7.2 and iOS 27.2. The developer described worse_query as a successor to an earlier vulnerability called bad_query. Binance’s November 10 warning separately identified iOS 26.7.1, 27.0.1 and 27.2 as affected versions.

What does worse_query allow?

Worse_query targets Apple’s application sandbox, which ordinarily confines an app to its own files and blocks access to other applications’ data. The published proof of concept shows how a configured app can cross those restrictions and reach unrelated apps’ data containers, shared App Group containers and certain system directories.

ForcequitOS described the original code as a developer tool that cannot operate independently without additional setup. Other developers have since built applications capable of using the technique.

WQ Files, developed by Christoph Kolbicz, lets users browse, export, modify and delete files belonging to other applications without jailbreaking an iPhone. That development turns the published research into a practical file-access tool with consequences for apps that hold wallet secrets.

What did Apple patch?

Apple’s official advisory says iOS 27.2.1 addresses nine vulnerabilities affecting AirPlay, Bluetooth, Messages, App Intents, Brotli, CoreUtils and rapportd. Apple made the update available for iPhone 11 and newer models, alongside supported iPads.

• App Intents: CVE-2026-113963 is an authorization vulnerability that could allow applications to access sensitive user information. Apple credited security researcher László Várady with discovering the issue and said improved state management resolved it. Apple’s documentation identifies a different affected component from the App Group mechanism used by worse_query.
• Messages: One vulnerability could allow a remote attacker to join an iMessage group conversation and receive messages without authorization. Another could allow newly added participants to access messages sent before they joined.
• Bluetooth and Brotli: Additional patches address Bluetooth pairing weaknesses and a Brotli memory-corruption vulnerability caused by specially crafted input.

What did Binance tell users to do?

Binance warned that malicious applications could access locally stored information belonging to other apps, potentially exposing wallet seed phrases, private keys and login credentials. A Binance spokesperson said the exchange had not identified any confirmed cryptocurrency theft linked to worse_query.

The warning specifically concerns applications capable of exploiting the sandbox vulnerability. The published exploit requires an application configured with an App Group container and does not independently compromise an iPhone through ordinary website browsing.

The exchange’s recommendations:

• Remove applications installed from untrusted sources, including sideloaded or manually signed IPA files.
• Update devices and applications to their latest official versions.
• If users suspect their credentials have been compromised, transfer assets to a new wallet created on a clean device and reset active login sessions.

What does this change for wallet users?

Installing iOS 27.2.1 alone does not remediate worse_query, according to forcequitOS. Users must also control which applications they install and treat untrusted IPA packages as a direct risk to locally stored wallet material. Binance has found no confirmed theft tied to the flaw, but that absence of confirmed losses does not remove the exposure when an untrusted app can browse other apps’ containers.

Until Apple releases a working fix and forcequitOS updates the project documentation, app removal, clean-device wallet creation and session resets will carry more weight than reliance on the latest iOS patch alone.