Public iOS Sandbox Escape Vulnerability Exposes Sensitive User Data
A newly disclosed iOS sandbox exploit allows unauthorized access to local application files.
1Critical Sandbox Escape Disclosed
A security researcher known as forcequitOS released a proof-of-concept exploit called worse_query on GitHub. This vulnerability affects iOS versions 26.7.1, 27.0.1, and 27.2. It allows malicious applications to bypass sandbox restrictions, enabling them to read, edit, or delete local files belonging to other applications installed on the same device.
2Binance Issues Security Warning
Binance issued an urgent warning regarding the vulnerability, noting that seed phrases, private keys, and login credentials are at risk. The exchange emphasized that this is an iOS-level issue, not specific to their platform. They advised users to remove apps from untrusted sources and immediately update all software to official versions.
3Exploit Mechanism and Requirements
The worse_query exploit functions by requiring an application to set up an App Group container. Once this container is established, the application can access data folders used by other apps. On iOS 27, the exploit can even reach certain system folders, all without requiring a jailbreak or a kernel-level exploit.
4Sideloading Tools Facilitate Access
While the researcher stated the code is intended for developers, others have already utilized it. Christoph Kolbicz developed a file manager called WQ Files, which leverages the exploit. Sideloading tools like AltStore and SideStore automatically create the necessary App Group containers, making the vulnerability accessible to users who install these third-party applications.
5Apple's Response Remains Unclear
Apple released security updates for iOS 26 and 27 shortly after the disclosure. However, the official release notes for iOS 26.7.3 and 27.2.1 do not mention a fix for worse_query. Apple typically does not discuss or confirm security issues until they have fully investigated the vulnerability and released a verified patch.
6Researcher Motivations and Frustration
The researcher, forcequitOS, collaborated with 0xjohnny to release the code. He stated he had no intention of seeking a bug bounty from Apple. He decided to publish the exploit early due to perceived stalling in Apple's communication and frustration regarding the inappropriate behavior of individuals publicly misusing or exaggerating the exploit.
7Recommended User Mitigation Steps
If a security breach is suspected, Binance recommends moving funds to a new wallet created on a clean, unaffected device. Users should also reset all active login sessions across their accounts. Deleting any apps installed via sideloading or manual signing is a critical step to minimize exposure to this sandbox vulnerability.
8Current Status of Exploitation
Despite the public availability of the proof-of-concept code, neither Binance nor the researcher has reported any active attacks or data theft involving worse_query. The long-term impact remains uncertain, as it is currently unknown whether an application distributed through the official App Store could successfully leverage this specific sandbox escape technique.