{"id":"TECH-202611-4dontq","kind":"technique","aliases":[],"related":[],"title":"Unpatched iOS sandbox escape (worse_query) lets a sideloaded app read, change and delete other apps' private files, including crypto wallet seed phrases and logins, on iOS 26 and 27 (public code, no fix, no CVE)","description":null,"summary":"A researcher who goes by forcequit (forcequitOS) published worse_query on GitHub on 8 Nov 2026. It is proof-of-concept code that lets an iPhone app reach every other app's data container, and some system folders on iOS 27, without a jailbreak. The app needs an App Group container. Sideloading tools such as AltStore and SideStore set that up on their own. Apps built on it are already out (WQ Files by Christoph Kolbicz, WorseFiles, Erosion), and they can read, edit and delete other apps' data. Binance and SlowMist warn that wallet seed phrases, private keys and login data stored on the phone are at risk. The researcher gives iOS 26.0 to 26.7.2 and iOS 27.x up to 27.2 as affected. Binance names 26.7.1, 27.0.1 and 27.2, and Erosion lists 27.2.1. Apple's 9 Nov updates (iOS 27.2.1, 26.7.3) do not list a fix, and Apple has said nothing. No attacks or thefts reported. It is unknown whether an App Store app could use it.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apple iOS","fixed":[],"affected":">= 26.0, <= 26.7.2; >= 27.0, <= 27.2 (researcher); 27.2.1 also listed by Erosion","ecosystem":"vendor"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Settings > General > About > iOS Version: iOS 26.0 to 26.7.x or 27.0 to 27.2.x should be treated as exposed (27.2.1 and 26.7.3 do not list a fix). Look for sideloaded or manually signed apps, meaning anything installed through AltStore, SideStore or a developer/enterprise profile (Settings > General > VPN & Device Management), and for apps named WQ Files / WQFiles, WorseFiles or Erosion. Whether App Store apps can use it is unknown.","fix":"No Apple fix yet. Remove sideloaded and manually signed apps you do not fully trust. Update iOS and all apps once Apple ships a fix. On managed iPhones, block sideloading and unknown profiles through MDM. Do not keep seed phrases or private keys in plain text on the phone. If you suspect a malicious app was installed, follow Binance's advice: move funds to a new wallet created on a clean device and sign out all active sessions.","status":"open","published_at":null,"first_seen_at":"2026-11-10T12:40:03+00:00","triaged_at":"2026-11-10T12:40:03+00:00","updated_at":"2026-11-10T12:41:53+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':38A '-4':39A '2026':62B '26':28A '26.0':160B '26.7.1':174B '26.7.2':162B '26.7.3':189B '27':30A,88B,165B '27.0.1':175B '27.2':169B,177B '27.2.1':181B,188B '8':60B '9':184B 'affect':171B 'alreadi':117B 'altstor':103B 'app':10A,16A,74B,78B,93B,96B,112B,134B,210B,212B 'appl':182B,196B 'apple':41A 'attack':201B 'binanc':136B,172B 'built':113B 'chang':12A 'christoph':122B 'code':32A,69B 'concept':68B 'contain':81B,98B 'could':213B 'crypto':20A 'cve':36A 'data':80B,135B,148B 'delet':14A,132B 'dontq':40A 'earli':44B 'early-warn':43B 'edit':130B 'eros':125B,179B 'escap':4A 'everi':76B 'file':18A,120B 'fix':34A,194B 'folder':85B 'forcequit':52B 'forcequito':53B 'github':58B 'give':158B 'goe':50B 'group':97B 'includ':19A 'io':2A,27A,87B,159B,164B,187B 'ios':42A 'iphon':73B 'jailbreak':91B 'key':145B 'kolbicz':123B 'let':7A,71B 'list':180B,192B 'login':25A,147B 'name':173B 'need':94B 'noth':199B 'nov':61B,185B 'phone':152B 'phrase':23A,143B 'privat':17A,144B 'proof':66B 'proof-of-concept':65B 'public':31A 'publish':54B 'queri':6A,56B 'reach':75B 'read':11A,129B 'report':204B 'research':48B,157B 'risk':155B 'said':198B 'sandbox':3A 'seed':22A,142B 'set':106B 'sideload':9A,99B 'sidestor':105B 'slowmist':138B 'store':149B,211B 'system':84B 'tech':37A 'techniqu':46B 'theft':203B 'tool':100B 'unknown':207B 'unpatch':1A 'updat':186B 'use':214B 'wallet':21A,141B 'warn':45B,139B 'whether':208B 'without':89B 'wors':5A,55B 'worsefil':124B 'wq':119B 'x':166B","nicknames":["worse_query"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["appleios","ios","worsequery"],"ptokens":["apple","ios"],"labels":["earlywarning","high","technique","vendor"],"campaign_type":"exploitation","search_a":"'-202611':38A '-4':39A '26':28A '27':30A 'app':10A,16A 'apple':41A 'chang':12A 'code':32A 'crypto':20A 'cve':36A 'delet':14A 'dontq':40A 'escap':4A 'file':18A 'fix':34A 'includ':19A 'io':2A,27A 'ios':42A 'let':7A 'login':25A 'phrase':23A 'privat':17A 'public':31A 'queri':6A 'read':11A 'sandbox':3A 'seed':22A 'sideload':9A 'tech':37A 'unpatch':1A 'wallet':21A 'wors':5A","search_b":"'2026':62B '26.0':160B '26.7.1':174B '26.7.2':162B '26.7.3':189B '27':88B,165B '27.0.1':175B '27.2':169B,177B '27.2.1':181B,188B '8':60B '9':184B 'affect':171B 'alreadi':117B 'altstor':103B 'app':74B,78B,93B,96B,112B,134B,210B,212B 'appl':182B,196B 'attack':201B 'binanc':136B,172B 'built':113B 'christoph':122B 'code':69B 'concept':68B 'contain':81B,98B 'could':213B 'data':80B,135B,148B 'delet':132B 'earli':44B 'early-warn':43B 'edit':130B 'eros':125B,179B 'everi':76B 'file':120B 'fix':194B 'folder':85B 'forcequit':52B 'forcequito':53B 'github':58B 'give':158B 'goe':50B 'group':97B 'io':87B,159B,164B,187B 'iphon':73B 'jailbreak':91B 'key':145B 'kolbicz':123B 'let':71B 'list':180B,192B 'login':147B 'name':173B 'need':94B 'noth':199B 'nov':61B,185B 'phone':152B 'phrase':143B 'privat':144B 'proof':66B 'proof-of-concept':65B 'publish':54B 'queri':56B 'reach':75B 'read':129B 'report':204B 'research':48B,157B 'risk':155B 'said':198B 'seed':142B 'set':106B 'sideload':99B 'sidestor':105B 'slowmist':138B 'store':149B,211B 'system':84B 'techniqu':46B 'theft':203B 'tool':100B 'unknown':207B 'updat':186B 'use':214B 'wallet':141B 'warn':45B,139B 'whether':208B 'without':89B 'wors':55B 'worsefil':124B 'wq':119B 'x':166B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-4dontq","url":"https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T12:40:03+00:00","fetched_at":"2026-11-10T12:40:03+00:00","note":null,"cites":["https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html","https://pbxscience.com/wqfiles-brings-a-no-jailbreak-file-browser-and-app-data-manager-to-ios-27/"]}],"documents":[{"id":114973,"url":"https://x.com/TheHackersNews/status/2120131862894895404","title":"@TheHackersNews: ‼️ A newly disclosed Apple iOS sandbox escape lets sideloaded apps access other ","kind":"post","source":"x","publisher":null,"text":"‼️ A newly disclosed Apple iOS sandbox escape lets sideloaded apps access other apps' private data without a jailbreak.\n\nA file manager built using the technique can read, edit, and delete other apps' files. Binance warns crypto wallet keys could be at risk.\n\nNo confirmed attacks https://t.co/3xT7SzK28i\n\nlikes 79 reposts 16","published_at":"2026-11-10T12:30:00+00:00","relation":"describes","confidence":null,"note":null},{"id":114979,"url":"https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html","title":"Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed","kind":"blog","source":"analyst","publisher":null,"text":"worse_query iOS sandbox escape by forcequit, released 8 Nov 2026 on GitHub. Lets an app with an App Group container read other apps' data containers (and some system folders on iOS 27) on iOS 26 and 27, no jailbreak. Binance warns seed phrases, private keys, logins at risk; named iOS 26.7.1, 27.0.1, 27.2 (tested by WQ Files). Researcher range iOS 26.0-26.7.2 and 27.x up to 27.2; Erosion lists 27.2.1. iOS 27.2.1 / 26.7.3 notes do not mention a fix. WQ Files (Christoph Kolbicz) file manager installs via AltStore/SideStore. Unknown whether App Store apps could use it. No attacks reported. Binance: delete sideloaded / manually signed apps, update iOS and apps; if breach suspected move funds to a new wallet on a clean device, reset sessions.","published_at":"2026-11-10T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":114980,"url":"https://pbxscience.com/wqfiles-brings-a-no-jailbreak-file-browser-and-app-data-manager-to-ios-27/","title":"WQFiles Brings a No-Jailbreak File Browser and App Data Manager to iOS 27","kind":"blog","source":"analyst","publisher":null,"text":"worse_query published 8 Nov 2026 by forcequitOS, successor to bad_query; targets iOS 26.0-26.7.2 and iOS 27.x up to 27.2 (third parties also list 27.3 beta 1). Requires App Group entitlement. WQFiles, Erosion, WorseFiles built on it; sideloaded IPAs.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":115112,"url":"https://news.ycombinator.com/item?id=50439813","title":"Worse_query iOS Critical Vulnerability","kind":"post","source":"hackernews","publisher":null,"text":"Worse_query iOS Critical Vulnerability\nhttps://twitter.com/binance/status/2120093246399430770\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-10T13:10:51+00:00","relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}