The researcher who published worse_query, the iOS sandbox escape Binance warned crypto users about on Tuesday, says Apple’s newest iPhone update does not fix it. That leaves a gap in the advice most users were given: updating to iOS 27.2.1 is still sensible, but by the researcher’s account it does not close this hole, and Apple has said nothing about the bug.
What Binance told users
Binance said a vulnerability called worse_query, affecting iOS 26.7.1, 27.0.1 and 27.2, “allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem.” The exchange stressed that “this is an iOS-level issue, not unique to Binance.”
It told users to delete apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and all apps to the latest official versions. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset active login sessions, it said. The warning has been viewed more than 1.7 million times.
Neither Binance nor the researcher has reported any theft linked to the bug, and no wallet app has been named as exposed.
The researcher says 27.2.1 does not patch it
Apple shipped iOS 27.2.1 and iOS 26.7.3 on Monday, the day after worse_query went public on GitHub. Several users and some security voices treated that as the fix. Decrypt reported that 23pds, chief information security officer at blockchain security firm SlowMist, urged users to install 27.2.1 and said it would block the escape.
The bug’s author disagrees. “Just as a general statement so there isn’t any confusion about it, worse_query is not patched in iOS 27.2.1 and 27.3 beta 1,” the developer who goes by forcequit said on Tuesday, about two hours after Binance’s warning. “I’ll update version support on the readme when it’s patched.”
Apple’s own documents do not settle it either way. The security notes for iOS 27.2.1 list nine fixes covering AirPlay, Bluetooth, iMessage, brotli and other components. None mentions a sandbox escape or credits forcequit. The closest entry is an App Intents authorization flaw through which “an app may be able to access sensitive user data,” credited to a different researcher. The iOS 26.7.3 notes carry eight fixes and do not include that entry. Apple’s standard policy is not to discuss security issues until a fix is available.
Why the version lists don’t match
Readers comparing sources have seen three different ranges. Binance named three versions. SlowMist’s threat-intelligence alert and the worse_query repository itself describe a wider one: “A sandbox escape for iOS 26.0 – 26.7.2 / 27.2.” The repository has not been updated since Sunday, which is why 27.2.1 is not on it.
Binance’s three versions line up exactly with the devices WQ Files, a file manager built on worse_query by developer Christoph Kolbicz, says it was tested on: iOS 27.0.1, 27.2 and 26.7.1, according to the app’s GitHub release notes. That suggests the exchange listed confirmed test devices rather than the full affected range. Binance has not said where its list came from.
A third project, the Erosion customization toolbox, now lists support for iOS 27.0 through 27.2.1 and the first 27.3 beta. Its developers added 27.2.1 on Tuesday with a commit note reading “pretty sure 27.2.1 is supported.” Nobody involved has said whether iOS 26.7.3 is affected, so owners of older iPhones on that release have no clear answer yet.
Who is actually exposed
The bug does not reach out and drain wallets on its own. The repository calls it a proof of concept for developers that “isn’t useful by itself,” and an app has to set up an App Group container to use it. SlowMist said the real risk starts when someone installs an app from an untrusted source, and that it matters most for wallets that keep seed phrases, keystores or WebView caches in plaintext on the phone.
The best-known tools built on it install through sideloading services such as AltStore and SideStore, which keep the App Group entitlement the escape needs. None of the developers involved has said whether an app distributed through the App Store could use the same technique.
forcequit, who credits developer 0xjohnny as a collaborator, has said in replies to other users that he found the bug in August and did not want to release it as a zero-day, and that Apple was slow to respond to him. The warning adds to a run of wallet-security scares in recent days, after Keplr paused Google and Apple logins over unauthorized transactions.
What to watch next
The next signal is an Apple security note that names worse_query or credits forcequit, or a change to the repository’s version list, which the researcher has said he will make once the bug is patched. Until then, the practical steps are the ones Binance and SlowMist gave: remove sideloaded apps, keep iOS current, and treat any device that has run an untrusted app as compromised for wallet purposes.
FAQ
Does iOS 27.2.1 fix worse_query?
Apple has not said so, and its 27.2.1 security notes do not mention the bug. The researcher who published it says it is not patched in 27.2.1 or the first 27.3 beta. A SlowMist executive has said the opposite, according to Decrypt.
Which iPhones are affected by worse_query?
The public proof of concept lists iOS 26.0 through 26.7.2 and iOS 27.2. Binance named 26.7.1, 27.0.1 and 27.2. Whether iOS 26.7.3 is affected has not been confirmed.
What should crypto users on iPhone do?
Delete apps from untrusted sources, update iOS and apps, and if an untrusted app has run on the device, move funds to a new wallet created on a clean device and reset login sessions, as Binance advised.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
