Worse Query iOS Sandbox Escape Can Expose App Data, Including Crypto Wallets
Summary
The Worse Query flaw reportedly lets malicious iOS apps access other apps’ private data. A public proof of concept demonstrates the technique; it requires an App Group container. Apple’s iOS 27.2.1 update did not mention the flaw.
Key points
- Worse Query reportedly affects iOS 26.7.1, 27.0.1, and 27.2; a working proof of concept was made public.
- The WQ Files demonstration accesses app data and, on iOS 27, backups, restores, and other listed resources.
- The exploit requires an App Group container; sideloading tools can create one automatically.
- Binance warned that seed phrases, private keys, and login credentials could be at risk.
- Apple released iOS 27.2.1, but the update did not mention the sandbox-escape flaw.
Article Details
- Vulnerability Types
- iOS application sandbox escape
- Affected Versions
- iOS 26.7.1
- iOS 27.0.1
- iOS 27.2
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unknown
CVE
People
Christoph KolbiczDemonstrated the Worse Query exploit using WQ Files and described its access and signing requirements; the article identifies him as the researcher behind the disclosures.WiiMeeCryptocurrency security educator who discussed fake wallet apps and the execution of exploits such as DarkSword from Safari.
Vendors
Products
iOSapplication Binance, which attackers recently breached and stole over $6 billion, warned Tuesday that the iOS issue could put "seed phrases, private keys and login credentials at risk across the entire ecosystem."WQ FilesSystems engineer Christoph Kolbicz demonstrated the exploit with WQ Files, a file manager built using the Worse Query sandbox escape technique.
Tools
AltStoreUsers can install WQ Files through sideloading tools such as AltStore, SideStore or Sideloadly, which automatically create the App Group container required for the exploit, making them the easiest option, Kolbicz said.ESignAlternatively, users can install the app through other signing tools, including Feather and ESign, but they need a digital certificate and a provisioning profile that supports App Groups. Wildcard profiles, which allowFeatherAlternatively, users can install the app through other signing tools, including Feather and ESign, but they need a digital certificate and a provisioning profile that supports App Groups. Wildcard profiles, which allowSideloadlyUsers can install WQ Files through sideloading tools such as AltStore, SideStore or Sideloadly, which automatically create the App Group container required for the exploit, making them the easiest option, Kolbicz said.SideStoreUsers can install WQ Files through sideloading tools such as AltStore, SideStore or Sideloadly, which automatically create the App Group container required for the exploit, making them the easiest option, Kolbicz said.