Three security alerts landed in my feed this morning. Binance, fresh off its own October hack, SlowMist and a third account all flagged the same iPhone bug, called worse_query. However, they disagree on which iOS versions are hit and whether Apple fixed it. So I checked every claim.
The short answer: worse_query is an iOS sandbox escape that lets a malicious app read files belonging to other apps. That can include a wallet’s seed phrase, if the wallet stores it badly. Still, the bug cannot drain anything by itself. First, a rogue app has to run on your phone, and so far that means sideloading.
What is worse_query?
Every iPhone app lives in its own sandbox. Think of it as a locked room. Normally, one app cannot open another app’s files. worse_query breaks that lock.
A researcher known as forcequitOS published the proof of concept on GitHub on November 8. It follows bad_query, a similar escape from August. However, this is not a jailbreak. It does not take over the whole phone. Instead, one app can reach into the data folders of other apps and read or change them.
The researcher says the code targets developers and is not useful by itself. Nevertheless, public code is public. As a result, anyone can now build on it, including scammers.
Which iOS versions are affected?
Here the reports split.
- The GitHub page lists iOS 26.0 through 26.7.2, plus iOS 27.2.
- Binance names three versions: iOS 26.7.1, 27.0.1 and 27.2.
- Some outlets also add the iOS 27.3 beta.
In other words, the wider range comes from the researcher. Binance’s shorter list matches the versions that one tool built on the bug was tested on. Therefore, treat any iPhone on those iOS 26 builds or on iOS 27.2 as exposed.
Did Apple fix worse_query?
Nobody outside Apple can say for sure yet.
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, one day after the code went public. SlowMist’s security chief says 27.2.1 stops worse_query. One of the alerts I received lists 27.2.1 as the fix as well. However, Apple’s security notes mention neither the bug nor any sandbox issue. Meanwhile, the developers of one tool built on worse_query believe it still runs on 27.2.1. No CVE number exists for it either.
So update anyway, because those releases patch other serious flaws. Just do not read the update as proof that this hole is closed.
Who is actually at risk?
Two conditions must both be true.
First, a malicious app has to run on your iPhone. The known tools built on worse_query install through sideloading, for example with AltStore or SideStore. Whether an App Store app could abuse the bug remains an open question.
Second, your wallet has to keep secrets as plain files. SlowMist points at seed phrases, keystores and WebView caches stored in plaintext. Well-built wallets encrypt that data instead. Unfortunately, you cannot easily check how your own wallet handles it.
So far, I found no reported thefts tied to worse_query. No wallet app has been named as exposed either. That makes this a warning, not a hack. By contrast, the Keplr Web3Auth breach last week led to unauthorized transactions on real accounts.
Therefore, sideloaders should worry most. Did you install a cracked app, a modded game or a “free premium” IPA on the phone that holds your wallets? Then act today.
What to do right now
These steps follow the Binance and SlowMist advice, in order.
- Update iOS. Open Settings, tap General, tap Software Update, and install iOS 27.2.1 or 26.7.3.
- Update every wallet and exchange app through the App Store.
- Delete every sideloaded or manually signed app. Also open Settings, General, VPN & Device Management and remove profiles you do not recognise.
- Did an untrusted app ever run on that phone? Then create a new wallet on a clean device and move your funds. The seed phrase versus private key guide explains why imported accounts need a separate move.
- Finally, reset active login sessions on your exchange accounts.
The App Store is not a guarantee either. For example, a fake Ledger app on the App Store simply asked victims for their seed phrase. Stolen funds rarely return, as I explained in can stolen crypto be recovered.
A phone wallet is a hot wallet
A phone runs dozens of apps, a browser and all your messages. Because of that, every mobile wallet is a hot wallet. Earlier this month, the DarkSword exploit chain was reportedly tied to losses for iPhone wallet users. worse_query adds a second reminder.
I run more than 100 wallets a year for airdrop farming. Farming wallets should be disposable, so a leak hurts little. You can pick one from our list of the best wallets for airdrops. Serious money belongs on a hardware wallet instead. My cold wallet guide covers the setup, and the Ledger safety review covers the most popular device.
I also keep a separate burner phone for account recoveries. A dedicated, clean device for wallets follows the same logic. Still unsure whether to hold keys at all? Then read self custody or exchange first.
Keep This Content Free
Checking three conflicting alerts takes time, and a post like this earns nothing per read. If you trade anyway, signing up through our referral links keeps these warnings free. Open an account on OKX or Bybit and you support the site at no extra cost.
Final Words
worse_query is serious, but panic is not needed. Update your iPhone, delete sideloaded apps and move funds if anything shady ever ran on it. After that, wait for Apple to confirm the fix. We will update this post once that happens.
Meanwhile, we track every major exploit under our security tag. The basics of airdrop safety live on our stay safe page.
FAQ
What is worse_query?
worse_query is a public proof of concept for an iOS sandbox escape. It lets one app read or change the data of other apps on the same iPhone.
Is worse_query fixed in iOS 27.2.1?
SlowMist says yes. However, Apple’s security notes do not mention it, so the fix is unconfirmed. Update anyway.
Can worse_query steal my crypto?
Not by itself. A malicious app must run on your phone first. Then it can read wallet data that is stored unencrypted.
Which iPhones are affected?
The researcher lists iOS 26.0 to 26.7.2 and iOS 27.2. Binance names 26.7.1, 27.0.1 and 27.2.
Credit: Source link
