Researcher forcequitOS confirmed that the worse_query vulnerability remained active in iOS 27.2.1 and the first iOS 27.3 beta
The worse_query exploit targets Apple's application sandbox security mechanism
Photo Credit: Unsplash/BoliviaInteligente
According to reports, the recent iOS 27.2.1 security update released by Apple failed to fix the vulnerability dubbed worst_query, which could expose wallet credentials for cryptocurrencies. The developer who discovered the vulnerability, dubbed forcequitOS, stated on November 10 that the security flaw was still live in iOS 27.2.1 as well as the first beta version of iOS 27.3, which contradicted speculation that Apple's latest update had patched the flaw. iOS 27.2.1 was rolled out by Apple on November 9, just one day after the source code of the exploit was posted by the researcher on GitHub. The security update mentions fixes to various components but does not include anything related to worst_query.
The disclosure has caused worry within the crypto community because Binance has stated that malicious apps may take advantage of the vulnerability to gain access to sensitive files from other apps, putting private keys and wallet recovery phrases at risk. In a statement posted on X on November 10, forcequitOS clarified any confusion about the vulnerability's status after Apple's latest software release.
According to the researcher, worse_query was “not patched in iOS 27.2.1 and 27.3 beta 1”, but assured that the documentation will be updated for the project once Apple provides a solution.
As mentioned in the GitHub repository, the vulnerability affects iOS versions ranging from 26.0 to 26.7.2, as well as 27.2. The developer referred to the exploit as the successor to another vulnerability named “bad_query.” “Worse_query” exploits the application sandbox provided by Apple, which restricts each application from accessing anything other than its own data.
How an application is able to overcome these restrictions and get access to data containers owned by other applications, including shared application groups and certain system directories, is illustrated by the published proof-of-concept. While the researcher has mentioned that the code is a developer utility and not possible to use in isolation, other developers have now developed applications that can make use of the technique.
In the security advisory from Apple, iOS 27.2.1 fixes nine vulnerabilities found in AirPlay, Bluetooth, Messages, App Intents, Brotli, CoreUtils, and rapportd. One of the bugs fixed by this update is CVE-2026-113963, which is a vulnerability in App Intents where apps could obtain access to user information due to authorisation problems. The security flaw was discovered by a researcher named László Várady, and Apple solved the problem using state management.
The researcher's statement followed a November 10 warning issued by Binance that listed iOS 26.7.1, 27.0.1, and 27.2 as some of the vulnerable versions of the software. The warning stated that malicious applications can gain access to information stored locally on devices for other applications, including seed phrases, private keys, and login details.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.