Apple's latest iPhone update leaves the 'worse_query' flaw unpatched

The flaw and its reported impact

The flaw is described as a sandbox escape. Under normal operation, iOS confines each application to its own storage area, and one application cannot read the files held by another. According to the researchers, worse_query breaks that separation: a malicious application installed on a device can read the local files of other applications without requiring the device to be jailbroken. Those files can include cryptocurrency seed phrases, private keys and login credentials stored by other applications on the device.

The mechanism was disclosed publicly through a proof-of-concept published on GitHub on 8 November 2026 by researchers identified as @0xjohnny and @forcequitOS. The publication of the proof-of-concept made the technical details of the flaw available to other researchers and, by extension, to potential attackers.

Confirmation that the flaw remains unpatched

On 10 November 2026, researcher @forcequitOS confirmed that the flaw had not been addressed in iOS 27.2.1, the latest public release, or in iOS 27.3 beta 1, the current developer beta. The confirmation was significant because it followed the release of iOS 27.2.1, which users might reasonably have expected to contain a fix.

Apple has issued no public statement on the flaw, and the security notes published alongside iOS 27.2.1 on 10 November 2026 make no mention of it. The absence of a reference in the release notes does not establish that Apple is unaware of the flaw, but it does mean that users have received no official guidance from the company on the matter.

Binance warning

On 10 November 2026, Binance, one of the largest cryptocurrency exchanges, warned iPhone users that the flaw placed cryptocurrency wallets at risk. The exchange's warning identified the affected versions as iOS 26.7.1, iOS 27.0.1 and iOS 27.2. The proof-of-concept repository lists a wider range of affected versions; this account uses the narrower list published by Binance, which is the more conservative statement of scope.

Binance's involvement raised the profile of the flaw considerably. A warning from a major exchange carries weight with users who hold digital assets on their phones, and the exchange's framing of the risk in terms of wallet security made the technical issue concrete for a non-specialist audience.

The reported attack route

The available evidence indicates that the exploit route involves applications installed outside the App Store. The flaw is reported to be exploitable by sideloaded or enterprise-signed applications, which are not subject to Apple's App Store review process. Applications distributed through the App Store remain subject to that review, and there is no evidence in the available sources that the flaw can be exploited through an App Store application.

This distinction matters for assessing the practical risk. Users who install applications only from the App Store face a lower exposure than users who install applications from outside it. The distinction does not eliminate the risk, however, because enterprise-signed applications are a recognised distribution channel, and malicious actors have previously used enterprise certificates to distribute software outside the App Store.

No attacks reported

No attacks or thefts attributed to the flaw have been reported as of the date of publication. The absence of reported exploitation is an important qualification: the flaw is a demonstrated vulnerability, not a documented incident. The publication of the proof-of-concept on 8 November 2026 increased the likelihood that the flaw would be studied and potentially exploited, but there is no public evidence that this has yet occurred.

The two-day interval between the proof-of-concept publication and the confirmation that the flaw remained unpatched also deserves note. The confirmation on 10 November 2026 followed the release of iOS 27.2.1 on the same day, which suggests that the update was not prepared in response to the disclosure.

Background and context

Sandbox escapes are among the more consequential categories of mobile security vulnerability because they undermine the isolation model on which the entire platform depends. iOS is designed around the principle that applications cannot access one another's data, and users store sensitive information, including financial credentials and authentication material, on the assumption that this isolation holds.

The flaw's name, worse_query, refers to the specific query mechanism through which the sandbox escape is achieved. The technical details are documented in the public proof-of-concept, but the practical significance is straightforward: an application that should be confined to its own data can read data belonging to other applications.

This incident also illustrates a recurring pattern in mobile security disclosure. A vulnerability is disclosed publicly with a proof-of-concept, the vendor's next scheduled release does not address it, and a major third party issues a warning while the vendor remains silent. Users are left to assess their own risk without official guidance, relying on the assessments of researchers and affected companies.

Why it matters

The flaw matters for three reasons. First, the data at risk includes cryptocurrency seed phrases and private keys, which, once exposed, cannot be revoked in the way a password can be changed. A seed phrase that has been read by a malicious application compromises the wallet permanently, and the owner must transfer funds to a new wallet to restore security.

Second, the flaw requires no jailbreak. Jailbreaking is a deliberate act by the user that carries well-known security implications, and users who jailbreak their devices accept a reduced level of protection. A flaw that operates on a standard, unmodified device affects a far larger population of users who have taken no such step.

Third, the flaw remains unpatched in the current releases, which means that the standard advice to keep software up to date does not resolve the exposure. Users who have installed iOS 27.2.1, the latest public release, remain affected according to the researchers' confirmation.

What comes next

The immediate question is whether Apple will address the flaw in a subsequent release and whether the company will acknowledge it publicly. Apple has not disclosed a timeline, and no statement from the company has been reported. The next scheduled release, or an unscheduled security update, would be the earliest opportunity for a fix to reach users.

In the meantime, the practical advice that follows from the available evidence is narrow. Users who hold cryptocurrency on their iPhones should avoid installing applications from outside the App Store and should review any sideloaded or enterprise-signed applications already on their devices. Users concerned about exposure should consider moving funds to a wallet on a device that does not run the affected versions, or to a hardware wallet, until a fix is released.

The reporting on this matter rests on two sources: 9to5Mac, which reported the Binance warning and the researchers' confirmation on 11 November 2026, and TechTimes, which reported the warning on 12 November 2026. Both outlets relied on the same underlying facts — the researchers' disclosure, the confirmation of the unpatched status, and the Binance warning — and the accounts are consistent.

Source: 9to5Mac / TechTimes