# Public iOS Sandbox Escape Vulnerability Exposes Sensitive User Data A newly disclosed iOS sandbox exploit allows unauthorized access to local application files. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/06ea2739-cecf-471e-bd0e-ed52bc3426fa ## Critical Sandbox Escape Disclosed A security researcher known as forcequitOS released a proof-of-concept exploit called worse_query on GitHub. This vulnerability affects iOS versions 26.7.1, 27.0.1, and 27.2. It allows malicious applications to bypass sandbox restrictions, enabling them to read, edit, or delete local files belonging to other applications installed on the same device. ## Binance Issues Security Warning Binance issued an urgent warning regarding the vulnerability, noting that seed phrases, private keys, and login credentials are at risk. The exchange emphasized that this is an iOS-level issue, not specific to their platform. They advised users to remove apps from untrusted sources and immediately update all software to official versions. ## Exploit Mechanism and Requirements The worse_query exploit functions by requiring an application to set up an App Group container. Once this container is established, the application can access data folders used by other apps. On iOS 27, the exploit can even reach certain system folders, all without requiring a jailbreak or a kernel-level exploit. ## Sideloading Tools Facilitate Access While the researcher stated the code is intended for developers, others have already utilized it. Christoph Kolbicz developed a file manager called WQ Files, which leverages the exploit. Sideloading tools like AltStore and SideStore automatically create the necessary App Group containers, making the vulnerability accessible to users who install these third-party applications. ## Apple's Response Remains Unclear Apple released security updates for iOS 26 and 27 shortly after the disclosure. However, the official release notes for iOS 26.7.3 and 27.2.1 do not mention a fix for worse_query. Apple typically does not discuss or confirm security issues until they have fully investigated the vulnerability and released a verified patch. ## Researcher Motivations and Frustration The researcher, forcequitOS, collaborated with 0xjohnny to release the code. He stated he had no intention of seeking a bug bounty from Apple. He decided to publish the exploit early due to perceived stalling in Apple's communication and frustration regarding the inappropriate behavior of individuals publicly misusing or exaggerating the exploit. ## Recommended User Mitigation Steps If a security breach is suspected, Binance recommends moving funds to a new wallet created on a clean, unaffected device. Users should also reset all active login sessions across their accounts. Deleting any apps installed via sideloading or manual signing is a critical step to minimize exposure to this sandbox vulnerability. ## Current Status of Exploitation Despite the public availability of the proof-of-concept code, neither Binance nor the researcher has reported any active attacks or data theft involving worse_query. The long-term impact remains uncertain, as it is currently unknown whether an application distributed through the official App Store could successfully leverage this specific sandbox escape technique. ## Sources covering this story - [Security Affairs — Public iOS Sandbox Escape Vulnerability Risks User Data](https://securityaffairs.com/202788/hacking/ios-sandbox-escape-is-public-and-apple-hasnt-confirmed-a-fix.html) - [The Hacker News — Binance Warns of iOS Sandbox Escape Risking Crypto Wallet Keys](https://thehackernews.com/2026/11/binance-warns-of-ios-sandbox-escape.html) - [Bitcoin News — Apple iOS Vulnerability Threatens Cryptocurrency Wallets](https://news.bitcoin.com/security/apple-ios-vulnerability-puts-crypto-wallets-risk-binance-issues-warning/) - [CryptoPotato — Binance Issues Security Warning Over Critical iOS Vulnerability](https://cryptopotato.com/binance-warns-about-a-major-threat-heres-the-best-protection/) - [Science & tech Articles | Mail Online — Urgent iPhone Security Warning Issued Over 'Worse_Query' Vulnerability](https://www.dailymail.com/sciencetech/article-16284707/iphone-binance-hack-warning.html?ns_mchannel=rss&ns_campaign=1490&ito=1490) - [9to5Mac — Binance Warns iPhone Users of Unpatched iOS Security Vulnerability](https://9to5mac.com/2026/11/11/binance-warns-iphone-crypto-holders-of-security-flaw-researchers-say-remains-unpatched/) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._