Researcher Claims iOS 27.2.1 Did Not Fix worse_query Vulnerability

The iOS 27.2.1 update released by Apple on November 9, 2026, according to researcher forcequitOS, did not fix the worse_query vulnerability related to bypassing app data access restrictions. The issue potentially affects the security of cryptocurrency wallets installed on iPhones.

On November 10, the researcher reported on social network X that the protection bypass method still works in the updated operating system and the first beta version of iOS 27.3.

"worse_query is not patched in iOS 27.2.1 and 27.3 beta 1," wrote forcequitOS. In translation: "The worse_query vulnerability is not fixed in iOS 27.2.1 and the first beta version of iOS 27.3." The developer also promised to update the project's documentation on GitHub once a working fix is available.

Meanwhile, Apple has not officially confirmed that the published update addresses worse_query specifically. Therefore, the status of the vulnerability is currently based on researchers' statements rather than a separate notification from the manufacturer.

Why worse_query poses a risk to crypto wallets

The vulnerability affects the iOS app isolation mechanism known as sandbox. Under normal conditions, it does not allow one program to freely view files of other applications.

The demonstration code published on November 8 shows the possibility of bypassing some of these restrictions. According to the researcher, the method affects various versions of iOS 26 and iOS 27, including iOS 26.0–26.7.2 and iOS 27.2.

Under certain conditions, a malicious application can gain access to files that are usually isolated from other programs. For crypto wallets, this creates a risk of exposing seed phrases, private keys, and account credentials if they are stored in accessible directories without additional protection.

However, the vulnerability does not imply automatic compromise of all crypto wallets. The possibility of obtaining secret data depends on the implementation of a specific application, including storage and encryption methods.

Moreover, to use the described method, an attacker needs to execute a malicious application on the device. Simply visiting a website does not trigger the published attack mechanism.

Apple fixed nine other security issues

In the iOS 27.2.1 bulletin, Apple listed nine vulnerabilities that were addressed. They affect AirPlay, Bluetooth, Messages, App Intents, and other components of the operating system.

Among the fixes is CVE-2026-113963, which allowed an application under certain conditions to access sensitive user data. However, Apple attributes it to the App Intents component, whereas worse_query is related to another data access mechanism. There is no separate mention of worse_query or confirmation of this issue being addressed in the published bulletin.

The update is available for iPhone 11 and newer models, as well as compatible iPads.

Binance recommended checking apps on iPhone

Earlier, on November 10, cryptocurrency exchange Binance warned users about the threat of wallet data exposure through worse_query.

The exchange recommended removing apps installed from unreliable sources, including unknown IPA packages, and updating the operating system and used programs through official channels. If there is a justified suspicion of seed phrase or private key compromise, Binance advises creating a new wallet on a trusted device and transferring assets to it. If account credentials may have been exposed, passwords should also be changed and active sessions terminated.

As of November 11, there have been no confirmed cases of cryptocurrency theft using worse_query.

Thus, the new statement from the researcher clarifies the status of the vulnerability following the release of iOS 27.2.1 but does not indicate mass attacks on iPhone owners. Users are advised to install official updates and avoid apps from unknown sources.