iOS 26 and 27 Sandbox Flaw Puts Plaintext Wallet Data at Risk

Researcher forcequitOS disclosed a sandbox flaw in iOS 26 and 27 that could let an unknown app read another app’s files after an unknown-source IPA installation.

An IPA is an iOS app package. The disclosed path begins when a user installs one from an unknown source. The installed app may then reach another app’s container, where application data resides.

The flaw carries the name “worse_query.” forcequitOS described it as a “container sandbox escape.” The mechanism breaks isolation between apps. The disclosed issue sits around stored app files. It does not sit inside a blockchain transaction.

That puts crypto wallets inside the potential impact zone. It does not make every wallet equally vulnerable. Exposure depends on what a wallet stores and how it stores that material.

What does worse_query actually allow?

The disclosed path runs through a local app installation. The source does not describe a remote network exploit. It names no victim count, affected-wallet count, or confirmed loss. The disclosure provides no dollar or token amount.

The research does not identify a known malicious package. It does not quantify exploitation. Nor does it name a vulnerable build beyond iOS 26 and 27.

That narrowness matters for risk assessment. A flaw disclosed for iOS 26 and 27 does not show that every device was compromised; installation path and storage method remain central to the disclosed risk.

Which wallet information could be exposed?

The potential data set includes:

• A mnemonic held in plaintext.
• A keystore held in plaintext.
• A WebView cache held in plaintext.

Each item shares one condition. Plaintext data in an app’s container could become readable if the sandbox fails. The source does not say every wallet stores these materials in plaintext or keeps them there.

That condition is narrower than saying a wallet app was compromised, because the disclosure requires both an unknown-source installation and plaintext storage before sensitive files could become exposed.

It also differs from an automatic drain. Exploitation, if it occurs, starts with file access. Any later action depends on what the exposed material allows.

SlowMist Chief Information Security Officer im23pds warned: “the flaw does not automatically steal assets.” The source reports no autonomous transfer mechanism. It reports no asset-loss figure. File disclosure and asset movement remain separate claims here. The disclosure supports only the first as a possible outcome.

What changes for wallet teams and users?

The practical check starts with storage. Wallet teams should identify whether a mnemonic, keystore or WebView cache stays in plaintext on the device. The source makes storage format decisive. It names no wallet brand, chain, token standard or protocol.

On the facts provided, two controls follow directly: avoid installing IPA packages from unknown sources, and review whether wallets write sensitive material in plaintext.

Neither step turns the disclosure into evidence of a completed attack. The risk still depends on each wallet’s storage design. For users, it also depends on the apps they choose to install.

No wallet vendor, blockchain, token standard or protocol is named. The described route runs through iOS app containers. No particular network is implicated.

What happens next?

No remediation deadline is stated. Any follow-up guidance should identify affected builds and state whether the path remains exploitable.

Until then, the risk remains conditional. An unknown-source IPA must come first. Possible access to plaintext data in another app’s container comes next. The disclosure supports concern and mitigation, not a conclusion that funds were automatically stolen. With no remediation deadline set, the next clear checkpoint is a technical advisory or patch for iOS 26 and 27.