Ethical Hacking News
Apple's iOS sandbox escape vulnerability has left iPhone users vulnerable to malicious apps that can read local files from other apps, putting sensitive data at risk. With no confirmed fix yet, users are advised to take precautions to protect themselves.
Apple's latest iOS update (26.7.1, 27.0.1, and 27.2) reveals a serious sandbox escape vulnerability (worse_query) that can allow malicious apps to read local files from other apps. The vulnerability was discovered by researcher forcequitOS and has been publicly disclosed on GitHub. The worse_query vulnerability can access sensitive data, including seed phrases, private keys, and login credentials, without a jailbreak or kernel exploit. Binance has warned its users about the vulnerability and advised them to update iOS and all apps to the latest official versions. Apple has not yet confirmed a fix for the vulnerability, sparking concerns among iPhone users. Malicious apps have already been built using the worse_query vulnerability, such as WQ Files, which can access data belonging to other apps without a jailbreak or kernel exploit.
Apple's latest security update for iOS, version 26.7.1, 27.0.1, and 27.2, has revealed a serious sandbox escape vulnerability that can allow malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. The vulnerability, known as "worse_query," was discovered by a researcher known as "forcequitOS" and has been publicly disclosed on GitHub.
According to forcequitOS, the worse_query vulnerability is the direct successor to a previous vulnerability called "bad_query" and essentially replaces it. To use the worse_query, an app must create an App Group container, which is a technique used to isolate apps from each other. However, this technique can also be used by malicious apps to access sensitive data from other apps.
The PoC exploit code for the worse_query vulnerability has been published on GitHub, and it can access the data folders used by all apps and, on iOS 27, some system folders as well. This means that malicious apps can potentially read sensitive data, including seed phrases, private keys, and login credentials, without the need for a jailbreak or kernel exploit.
Binance, a cryptocurrency exchange, has warned its users about the vulnerability and advised them to remove apps installed from untrusted sources, update iOS and all apps to the latest official versions, and, if a breach is suspected, move funds to a new wallet on a clean device and reset all active login sessions.
Apple has not confirmed a fix for the vulnerability yet, which has raised concerns among iPhone users. ForcequitOS has stated that they have no intention of seeking a bug bounty from Apple and are willing to give up any potential reward because of Apple's delayed response and the inappropriate behavior of people publicly misusing or exaggerating the exploit.
The worst part is that malicious apps have already been built using the worse_query vulnerability, such as WQ Files, a file manager that can access data belonging to other apps without requiring a jailbreak or a kernel exploit. Users can install WQ Files through sideloading tools such as AltStore and SideStore, which automatically create the required App Group when users sign in with their Apple ID.
In conclusion, the iOS sandbox escape vulnerability is a serious security issue that can potentially expose sensitive data from iPhone users. Apple needs to act quickly to fix the vulnerability and provide a secure update to its users.
Related Information:
https://www.ethicalhackingnews.com/articles/Apples-Sandbox-Vulnerability-Leaves-iPhone-Users-Vulnerable-to-Malicious-Apps-ehn.shtml
https://securityaffairs.com/202788/hacking/ios-sandbox-escape-is-public-and-apple-hasnt-confirmed-a-fix.html
Published: Tue Nov 10 12:34:04 2026 by llama3.2 3B Q4_K_M
