worse_query lets iOS apps read other apps' files, and no Apple patch is listed

A zero-day in iOS container isolation

A zero-day iOS vulnerability called worse_query lets malicious apps read files belonging to other apps. Security researcher forcequitOS published a working proof-of-concept on GitHub on 8 November 2026. The bug was described as the successor to an earlier exploit, bad_query.

iOS normally keeps each app in an isolated sandbox. Worse_query abuses a query interface in the container manager through symbolic links inside an app group container. This allows a malicious app to read, modify or delete databases, documents, caches and configuration files of other apps without a jailbreak or a kernel exploit, according to analysis by the security firm Ostorlab.

Binance warning, limited patch

Binance issued a warning on X on 10 November 2026. It said the issue affects iOS at the system level, including versions 26.7.1, 27.0.1 and 27.2. It added: «This is an iOS-level issue, not unique to Binance.» The exchange told users to delete apps installed from untrusted sources and to update iOS to the latest official version.

Apple released iOS 27.2.1 and iOS 26.7.3 on 9 November 2026. Its security notes do not mention a fix for sandbox escapes and assign no CVE identifier to worse_query. Ostorlab said the gap remains open with no confirmed patch from the manufacturer. Because no CVE has been assigned, the flaw was not in CISA's Known Exploited Vulnerabilities catalogue as of 10 November 2026.

The wallet risk is conditional

According to SlowMist's head of information security, known as 23pds, the bug does not steal funds by itself. A theft would need two conditions at once: the user installs and runs a malicious app from outside the App Store, and the affected wallet stores seed phrases, keystore files or WebView caches in plaintext in a locally accessible folder.

Tools derived from the exploit, circulated publicly as WQ Files, can already read, modify and delete third-party files. No confirmed crypto theft through worse_query had been reported as of the report. SlowMist recommended against sideloading IPAs, keeping iOS current, storing sensitive data only in encrypted form, and moving assets to a new wallet created on a clean device if an untrusted app was installed.

Apple had not published a notice or a corrected version for worse_query, Ostorlab said. The exploit remains active with public code available.