Apple’s iOS 27.2.1 update fixes nine security flaws — but it leaves one serious hole open. A vulnerability nicknamed “worse_query” can let a malicious app read files belonging to other apps on your iPhone, including crypto wallet credentials, recovery phrases and private keys. The researchers who found it say the flaw is still live in iOS 27.2.1 and in the first beta of iOS 27.3.
Crypto exchange Binance warned iPhone users about the bug on November 10, 2026. Proof-of-concept exploit code was posted publicly on GitHub on November 8, one day before iOS 27.2.1 shipped — and the update’s security notes make no mention of a fix.
Key Takeaways
- The bug: “worse_query” lets a malicious app read local files belonging to other apps, bypassing the iOS sandbox.
- What is at risk: crypto wallet seed phrases, private keys and login credentials stored in local app files.
- Not fixed: researcher forcequitOS confirmed the flaw is still live in iOS 27.2.1 and in iOS 27.3 beta 1.
- Versions affected: Binance lists iOS 26.7.1, 27.0.1 and 27.2; the flaw affects iOS 26.0–26.7.2 and 27.2.
- Exploitation: no confirmed cases of attacks or crypto theft tied to the flaw have been reported.
- Still install 27.2.1: it fixes nine other flaws, including two iMessage group-chat bugs.
What Is the “worse_query” Bug?
The flaw was found by two independent security researchers, known online as @0xjohnny and @forcequitOS, who first discovered it in August 2026. It breaks one of the core promises of iOS security: the app sandbox. Normally, each app lives in its own sealed container and cannot see another app’s files. worse_query gets around that.
According to a technical breakdown by security firm Ostorlab on November 10, the trick uses App Groups — shared folders Apple lets a developer’s apps and extensions use to exchange data. A malicious app that reaches an App Group container can open files stored by other apps. No jailbreak and no kernel exploit is needed.
The danger is concrete. Developers have already built on the published proof-of-concept code: Christoph Kolbicz released WQ Files, a file browser that uses the same technique to open and edit other apps’ data. If a wallet app stores a seed phrase or private key in a local file, a rogue app could read it. (The researchers call it “worse_query”; some coverage spells it “worst_query” — the same vulnerability.)
There is one important limit: the flaw cannot be triggered by a website or a message. A malicious app has to be installed first, so the main risk comes from sideloaded apps and manually signed IPA files.
What iOS 27.2.1 Actually Fixes
Apple released iOS 27.2.1 on November 9, 2026, for iPhone 11 and later, alongside iOS 26.7.3 and iOS 18.7.12 for older devices. Its security notes list nine fixes across seven system components — and none of them is for the app sandbox that worse_query abuses.
The fixes include two iMessage group-chat flaws (CVE-2026-113961 and CVE-2026-113960), an App Intents privacy flaw (CVE-2026-113963), and several Bluetooth and AirPlay pairing bugs. Apple’s advisory does not name worse_query.
On November 10, forcequitOS confirmed that worse_query is not patched in iOS 27.2.1 or in iOS 27.3 beta 1. Apple has not issued a public statement about the flaw, has published no advisory or CVE for it, and has not said when a fix might arrive.
Binance’s Warning to iPhone Users
Binance posted its warning on X on November 10, 2026. The exchange said the bug “allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem” — and stressed that “this is an iOS-level issue, not unique to Binance.” A Community Note added to the post described the flaw as an unpatched zero-day.
The good news, for now, is the absence of confirmed damage. Neither Binance nor the researchers have reported any attacks or cryptocurrency thefts tied to worse_query, and The Hacker News has reported the same. The exploit code is public, though — so there is no evidence yet of theft, but the risk is real.
What iPhone Users Should Do
Until Apple ships a fix, the advice is straightforward — and it starts with where your apps come from.
Install iOS 27.2.1 anyway. It does not fix worse_query, but it closes nine real flaws, including the two iMessage bugs. Open Settings, tap General, then Software Update.
Do not sideload apps. Avoid apps from outside the App Store, including manually signed IPA files — this is the one realistic way the flaw reaches a device.
Review the apps on your phone. Remove anything you do not recognise, especially anything installed outside the App Store.
Keep seed phrases offline. A recovery phrase written on paper cannot be read by a malicious app. Avoid storing seed phrases or private keys in plain text files, notes apps or screenshots.
Consider a hardware wallet for larger holdings. Keeping most funds on a hardware wallet limits what any single phone-based flaw can expose. Then watch for Apple’s next update — the fix will most likely arrive in a future iOS 27.2.x or 27.3 release.
Related Guides
- iOS 27.2.1 Fixes an iMessage Flaw That Could Let Strangers Read Your Group Chats
- iPhone XS and XR Owners: Install iOS 18.7.11 Now — It Fixes an Exploited Zero-Day
- iPhone Duo Crosses 100,000 Optimized Apps Milestone
Frequently Asked Questions
Q: What is the worse_query bug on iPhone?
A: worse_query is an iOS sandbox vulnerability found by researchers @0xjohnny and @forcequitOS. It lets a malicious app read local files belonging to other apps, including crypto wallet seed phrases, private keys and login credentials. It works through App Groups shared containers, with no jailbreak needed.
Q: Does iOS 27.2.1 fix the worse_query vulnerability?
A: No. Researcher forcequitOS confirmed on November 10, 2026 that worse_query is not patched in iOS 27.2.1 or in iOS 27.3 beta 1. Apple’s iOS 27.2.1 security notes list nine fixes, but none covers the app sandbox this flaw abuses.
Q: Which iOS versions are affected by worse_query?
A: Binance lists iOS 26.7.1, 27.0.1 and 27.2 as vulnerable, and the flaw affects iOS 26.0–26.7.2 and 27.2. Researchers say iOS 27.2.1 and the first iOS 27.3 beta are still vulnerable too.
Q: Has worse_query been used to steal crypto yet?
A: No confirmed cases have been reported. Neither Binance nor the researchers have reported attacks or thefts tied to worse_query. The proof-of-concept code is public, though, so the risk is real.
Q: How can iPhone users protect their crypto wallets from worse_query?
A: Install iOS 27.2.1 for its other nine security fixes, do not sideload apps or install manually signed IPA files, remove apps you do not recognise, keep seed phrases offline on paper, and consider a hardware wallet for larger holdings until Apple ships a fix.
Sources: Gadgets360 (Nov 12, 2026); NewsBytes (Nov 12, 2026); Bitdefender (Nov 12, 2026); talkwithtech (Nov 12, 2026); Mac Observer (Nov 12, 2026); Blockonomi (Nov 12, 2026); PhoneArena (Nov 12, 2026); Tech Times (Nov 12, 2026); Ostorlab technical breakdown (Nov 10, 2026); Binance on X (Nov 10, 2026); Apple security advisories for iOS 27.2.1.
