Home
Cryptocurrency
Cryptocurrency News
Apple Leaves Crypto Wallet Security Bug Unresolved in Latest iOS Update

Apple Leaves Crypto Wallet Security Bug Unresolved in Latest iOS Update

Researcher forcequitOS confirmed that the worse_query vulnerability remained active in iOS 27.2.1 and the first iOS 27.3 beta

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 12 November 2026 19:15 IST

Apple Leaves Crypto Wallet Security Bug Unresolved in Latest iOS Update

Photo Credit: Unsplash/BoliviaInteligente

The worse_query exploit targets Apple's application sandbox security mechanism

Click Here to Add Gadgets360 As A Trusted Source

Highlights

The vulnerability affects iOS 26 and iOS 27 versions
The proof of concept demonstrates access to other apps' data
Apple's latest update addressed nine other security vulnerabilities

According to reports, the recent iOS 27.2.1 security update released by Apple failed to fix the vulnerability dubbed worst_query, which could expose wallet credentials for cryptocurrencies. The developer who discovered the vulnerability, dubbed forcequitOS, stated on November 10 that the security flaw was still live in iOS 27.2.1 as well as the first beta version of iOS 27.3, which contradicted speculation that Apple's latest update had patched the flaw. iOS 27.2.1 was rolled out by Apple on November 9, just one day after the source code of the exploit was posted by the researcher on GitHub. The security update mentions fixes to various components but does not include anything related to worst_query.

Binance Previously Warned iPhone Users About Risks to Locally Stored Wallet Credentials

The disclosure has caused worry within the crypto community because Binance has stated that malicious apps may take advantage of the vulnerability to gain access to sensitive files from other apps, putting private keys and wallet recovery phrases at risk. In a statement posted on X on November 10, forcequitOS clarified any confusion about the vulnerability's status after Apple's latest software release.

Apple Ios Discussion

Explore More...

According to the researcher, worse_query was “not patched in iOS 27.2.1 and 27.3 beta 1”, but assured that the documentation will be updated for the project once Apple provides a solution.

Suiet Wallet Calls It Quits, Marking Another Exit From Sui Ecosystem

As mentioned in the GitHub repository, the vulnerability affects iOS versions ranging from 26.0 to 26.7.2, as well as 27.2. The developer referred to the exploit as the successor to another vulnerability named “bad_query.” “Worse_query” exploits the application sandbox provided by Apple, which restricts each application from accessing anything other than its own data.

How an application is able to overcome these restrictions and get access to data containers owned by other applications, including shared application groups and certain system directories, is illustrated by the published proof-of-concept. While the researcher has mentioned that the code is a developer utility and not possible to use in isolation, other developers have now developed applications that can make use of the technique.

In the security advisory from Apple, iOS 27.2.1 fixes nine vulnerabilities found in AirPlay, Bluetooth, Messages, App Intents, Brotli, CoreUtils, and rapportd. One of the bugs fixed by this update is CVE-2026-113963, which is a vulnerability in App Intents where apps could obtain access to user information due to authorisation problems. The security flaw was discovered by a researcher named László Várady, and Apple solved the problem using state management.

Bitcoin Fails to Reclaim $75,000 as Broader Crypto Market Sentiment Remains Weak

The researcher's statement followed a November 10 warning issued by Binance that listed iOS 26.7.1, 27.0.1, and 27.2 as some of the vulnerable versions of the software. The warning stated that malicious applications can gain access to information stored locally on devices for other applications, including seed phrases, private keys, and login details.

Across Protocol Recovers Website After Hackers Seize Control of Domain

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Apple iOS, binance hack, Crypto Scam

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More