Apple's latest iOS 27.2.1 security update is reportedly unable to fix the worse_query vulnerability. Although this update fixes nine other security issues, this vulnerability may lead to the exposure of cryptocurrency wallet credentials.

• Apple's update on 27.2.1 fixed nine security vulnerabilities, but researchers of the worse_query vulnerability claim that this issue has not yet been resolved.
• The worse_query vulnerability allows malicious applications to bypass the iOS sandbox restrictions and may access sensitive information stored in encrypted wallets.
• Binance urges crypto users to delete untrusted applications, update their devices, and transfer funds to new wallets if they suspect that their credentials have been compromised.
• Apple's official security statement does not list 'worse_query' as one of the issues fixed in this update.

The researcher of this vulnerability exploitation method, forcequitOS, stated on November 10th that the vulnerability was still valid in the first test versions of iOS 27.2.1 and iOS 27.3, which contradicts the claim by the outside world that Apple's latest update had resolved this issue.

Apple released iOS 27.2.1 on November 9th, which was a day after the researcher published the exploit source code on GitHub. Apple's official security statement listed fixes for multiple components, but did not mention worse_query.

After Binance warned that malicious applications could exploit this vulnerability to access sensitive files of other applications, potentially exposing private keys and wallet mnemonic phrases, this revelation has raised concerns among cryptocurrency users.

Researchers claim that the issue with 'worse_query' has not been fixed in iOS 27.2.1.

In a statement published on X on November 10th, forcequitOS directly addressed the confusion surrounding the status of this vulnerability after Apple's latest software release.

The researcher stated that the issue with 'worse_query' was not fixed in either iOS on 27.2.1 or in beta on 27.3, and mentioned that they would update the project documentation after Apple releases an effective fix for it.

According to the repository information of GitHub, this vulnerability impact versions from 26.0 to 26.7.2 of iOS and version 27.2 of iOS. Developers refer to it as a successor version of a previous vulnerability known as bad_query.

worse_query targets Apple's app sandbox mechanism. This mechanism typically limits each app to only accessing its own files and prevents it from unauthorized access to information stored by other apps.

Published proof-of-concept demonstrations have shown that an application can bypass these restrictions and access data containers of unrelated applications, including shared application groups as well as certain system directories.

Although researchers claim that the initially released code was merely a developer tool that could not be used independently without additional configuration, other developers have since created applications that utilize this technology.

One example is WQ Files developed by Christoph Kolbicz. This application allows users to browse, export, modify, and delete files from other applications without the need to jailbreak iPhone.

Apple's latest security update fixes nine separate vulnerabilities.

According to Apple's official security announcement, iOS 27.2.1 has fixed nine vulnerabilities that affected AirPlay, Bluetooth, Messages, App Intents, Brotli, CoreUtils, and rapportd.

This includes CVE-2026-113963, which is an authorization vulnerability within App Intents that may allow applications to access users' sensitive information.

Apple attributed the issue to the discovery of security researcher Lá szl ó Vá rady, and stated that the problem has been resolved through improvements to state management.

Although this vulnerability also involves unauthorized access to sensitive information, Apple's documentation indicates that the component affected is different from the App Group mechanism exploited by worse_query.

This update also fixed two Messages vulnerabilities, one of which could allow remote attackers to join the iMessage group chat without authorization and receive messages.

Another vulnerability may allow newly joined participants to access messages sent before they joined the conversation.

Other patches also fixed vulnerabilities in Bluetooth pairing, as well as a memory corruption bug (identified by the code Brotli) that could be triggered by specially crafted inputs.

Apple has provided this update for the iPhone 11 and later models, as well as the supported iPad.

Binance warns that encrypted wallets may be at risk of exposure

Before the researchers issued a statement, Binance had already issued a warning on November 10, indicating that the affected software versions included iOS 26.7.1, 27.0.1, and 27.2.

As previously reported by crypto.news, Binance warned that malicious applications may access information stored locally on other apps, which could potentially expose wallet seed phrases, private keys, and login credentials.

A spokesperson for Binance stated that the exchange has not yet discovered any confirmed cases of cryptocurrency theft related to worse_query.

Binance recommends that users delete applications installed from untrusted sources, including side-loaded or manually signed IPA files, and update their devices and applications to the latest official versions.

For users who suspect that their credentials have been leaked, Binance recommends transferring their assets to a new wallet created on a clean device and resetting the current active login session.

This warning is specifically aimed at applications that can exploit this sandbox vulnerability. The publicly disclosed vulnerabilities require the use of a App Group container for exploitation, which means that this technique cannot be used to independently crack a iPhone simply by browsing an ordinary web page.

Therefore, Binance's advice goes beyond just installing the latest software updates from Apple. While this vulnerability remains concerning, the exchange also urges users to avoid using unauthorized application installation packages.