What Does the Worse_Query Flaw Actually Allow?
The public proof of concept for worse_query describes a sandbox escape affecting iOS 26.0 through 26.7.2 and iOS 27 through 27.2. Apple’s sandbox normally isolates each application’s data so one app cannot freely browse files belonging to another.The proof of concept demonstrates access to directories containing application data, plug-in data, shared app groups and some system containers. That creates a potential path for a hostile application to inspect files that another app assumes are isolated.For cryptocurrency users, the financial risk depends heavily on how individual wallets store their secrets. A wallet that keeps recovery information or key material in readable local files could be more exposed than one relying on encrypted storage, hardware-backed protection or Apple’s Secure Enclave.The research does not establish that every wallet is vulnerable, and there is currently no confirmed theft publicly attributed specifically to worse_query. The repository also describes the code as a developer proof of concept rather than a jailbreak or ready-made wallet-stealing tool.
Investor Takeaway
Do Apple’s Latest Updates Fix the Problem?
Apple’s November 9 security releases address several vulnerabilities, including issues affecting sensitive user data, Bluetooth and system components. However, neither the iOS 27.2.1 nor iOS 26.7.3 advisory explicitly refers to worse_query.The public worse_query repository currently lists affected releases only through iOS 26.7.2 and iOS 27.2, which stops immediately before Apple’s latest stable updates. That may indicate the technique no longer works on the newest versions, but Apple has not publicly confirmed that interpretation in its security documentation.Binance advised users to install the latest official iOS version and update their applications, while removing software downloaded from untrusted sources. The risk is particularly relevant to sideloaded or manually signed applications because exploitation requires malicious code to be running on the device.The warning adds to a series of recent concerns around Apple devices and crypto custody. FinanceFeeds recently reported that older iPhones may carry hardware-level vulnerabilities that cannot be fixed through ordinary software updates, although exploiting those weaknesses does not automatically reveal wallet credentials.
Investor Takeaway
Why Are Crypto Wallets a High-Value Target on Apple Devices?
Crypto holders have repeatedly been targeted through malicious applications because wallet recovery phrases provide a direct route to assets without requiring access to a bank or exchange account.Earlier this year, Apple removed a fraudulent Ledger application linked to about $9.5 million in cryptocurrency theft. That case relied on users entering their recovery phrases into a fake application rather than a sandbox escape, but it showed the financial value attackers place on credentials stored or entered on consumer devices.FinanceFeeds also covered a previous Trust Wallet warning involving an iOS zero-day threat, adding to concerns about how operating-system vulnerabilities can affect self-custody even when the wallet application itself is not the initial point of compromise.Binance said users who believe a malicious application may already have accessed their device should create a new wallet on a clean device and move their assets rather than relying only on deleting the suspicious app. They should also terminate active sessions and replace any potentially exposed login credentials.