--- id: "TECH-202611-4dontq" page: "https://infrastack.ai/live/TECH-202611-4dontq" kind: "technique" aliases: [] title: "Unpatched iOS sandbox escape (worse_query) lets a sideloaded app read, change and delete other apps' private files, including crypto wallet seed phrases and logins, on iOS 26 and 27 (public code, no fix, no CVE)" severity: "high" cvss: null epss: null exploited: false status: "open" category: "vendor" products: [{"name": "Apple iOS", "fixed": [], "affected": ">= 26.0, <= 26.7.2; >= 27.0, <= 27.2 (researcher); 27.2.1 also listed by Erosion", "ecosystem": "vendor"}] ecosystems: [] tags: ["early-warning", "technique"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T12:40:03+00:00" updated_at: "2026-11-10T12:41:53+00:00" sources: [{"source": "analyst", "url": "https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html", "first_seen_at": "2026-11-10T12:40:03+00:00", "cites": ["https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html", "https://pbxscience.com/wqfiles-brings-a-no-jailbreak-file-browser-and-app-data-manager-to-ios-27/"]}] exploit_sources: [] --- # Unpatched iOS sandbox escape (worse_query) lets a sideloaded app read, change and delete other apps' private files, including crypto wallet seed phrases and logins, on iOS 26 and 27 (public code, no fix, no CVE) Link for people: https://infrastack.ai/live/TECH-202611-4dontq (this .md is for agents) A researcher who goes by forcequit (forcequitOS) published worse_query on GitHub on 8 Nov 2026. It is proof-of-concept code that lets an iPhone app reach every other app's data container, and some system folders on iOS 27, without a jailbreak. The app needs an App Group container. Sideloading tools such as AltStore and SideStore set that up on their own. Apps built on it are already out (WQ Files by Christoph Kolbicz, WorseFiles, Erosion), and they can read, edit and delete other apps' data. Binance and SlowMist warn that wallet seed phrases, private keys and login data stored on the phone are at risk. The researcher gives iOS 26.0 to 26.7.2 and iOS 27.x up to 27.2 as affected. Binance names 26.7.1, 27.0.1 and 27.2, and Erosion lists 27.2.1. Apple's 9 Nov updates (iOS 27.2.1, 26.7.3) do not list a fix, and Apple has said nothing. No attacks or thefts reported. It is unknown whether an App Store app could use it. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Apple iOS affected >= 26.0, <= 26.7.2; >= 27.0, <= 27.2 (researcher); 27.2.1 also listed by Erosion fixed no fixed version listed ## How to check Settings > General > About > iOS Version: iOS 26.0 to 26.7.x or 27.0 to 27.2.x should be treated as exposed (27.2.1 and 26.7.3 do not list a fix). Look for sideloaded or manually signed apps, meaning anything installed through AltStore, SideStore or a developer/enterprise profile (Settings > General > VPN & Device Management), and for apps named WQ Files / WQFiles, WorseFiles or Erosion. Whether App Store apps can use it is unknown. ## Fix No Apple fix yet. Remove sideloaded and manually signed apps you do not fully trust. Update iOS and all apps once Apple ships a fix. On managed iPhones, block sideloading and unknown profiles through MDM. Do not keep seed phrases or private keys in plain text on the phone. If you suspect a malicious app was installed, follow Binance's advice: move funds to a new wallet created on a clean device and sign out all active sessions. ## Timeline - 2026-11-10T12:40:03+00:00 analyst https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html ## Documents - [describes] @TheHackersNews: ‼️ A newly disclosed Apple iOS sandbox escape lets sideloaded apps access other https://x.com/TheHackersNews/status/2120131862894895404 - [describes] Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html - [describes] WQFiles Brings a No-Jailbreak File Browser and App Data Manager to iOS 27 https://pbxscience.com/wqfiles-brings-a-no-jailbreak-file-browser-and-app-data-manager-to-ios-27/ - [discussion] Worse_query iOS Critical Vulnerability https://news.ycombinator.com/item?id=50439813 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_