Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

Public iOS sandbox escape can read other apps' files

Original title: iOS Sandbox Escape Is Public, and Apple Hasn’t Confirmed a Fix

Security Affairsby Pierluigi Paganini ()2 min read1 · 1 read
Read at securityaffairs.com
Part of a story covered by 4 sourcesBinance warns public iOS sandbox escape can expose wallet filesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Binance says worse_query hits iOS 26.7.1, 27.0.1 and 27.2; no attacks are reported and Apple has not confirmed a fix.

Binance warned on November 10 that a public iOS sandbox escape, worse_query, lets a malicious app read local files of other apps, including seed phrases, private keys and login credentials. Researcher forcequitOS published proof-of-concept code on GitHub, and a sideloadable file manager, WQ Files, is already built on the technique. Apple issued iOS security updates the next day, but release notes do not list a fix. Neither Binance nor the researcher has reported attacks or data theft.

Unconfirmed: Apple has not confirmed that its subsequent iOS updates fix worse_query, and no attacks have been reported.

Key facts
  • Affected versions named by Binance are iOS 26.7.1, 27.0.1 and 27.2.
  • The PoC needs an App Group container and, the researcher says, is not useful by itself.
  • On iOS 27 the technique can also reach some system folders.
  • WQ Files can view, edit, delete and clear other apps' data without a jailbreak.
  • Binance advises removing untrusted apps, updating iOS, and moving funds if compromise is suspected.
Security assessment · AI, from the articlePublic proof of concept

Impact: Malicious apps can read other apps' local files and credentials

ProductAffected
Apple iOS26.7.1, 27.0.1, and 27.2
What to do
  1. 1.Remove apps installed from untrusted sources and update iOS and apps.
  2. 2.If compromise is suspected, move funds to a new wallet on a clean device and reset sessions.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
iossandbox-escapeapplebinancepoccryptocurrency
Vendors
Apple
Products
iOSWQ Files
Malware
worse_query
Organizations
Binance

From the original article

2 min read at securityaffairs.com

A public iOS sandbox escape could expose wallet keys, Binance warns. No attacks are reported and no fix is confirmed. On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps.

Security Affairs

By Pierluigi Paganini · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.