Apple iOS 27.2.1 Update Leaves Wallet Exploit Unpatched

Apple’s latest iOS 27.2.1 security update has failed to patch the worsequery vulnerability, which could potentially expose cryptocurrency wallet credentials, according to reporting by CryptoNews. Released on November 9, the iOS 27.2.1 update addresses nine separate security vulnerabilities, but official security notes do not mention worsequery among the fixes.

The researcher behind the exploit, known as forcequitOS, stated on November 10 that the vulnerability remains active in both iOS 27.2.1 and the first beta of iOS 27.3. The disclosure follows the publication of the exploit's source code on GitHub on November 8.

Sandbox Bypass Mechanism

The worsequery vulnerability targets Apple’s application sandbox, which normally restricts each app's access to its own files. According to the developer, the exploit affects iOS versions 26.0 through 26.7.2 and iOS 27.2, serving as a successor to an earlier vulnerability named badquery.

The published proof of concept demonstrates how an application can bypass sandbox restrictions to reach data containers belonging to unrelated apps, including shared application groups. While the original code requires an application configured with an App Group container and cannot independently compromise an iPhone through ordinary website browsing, other developers have built applications like WQ Files to browse and modify files without jailbreaking.

Binance Security Warning

Following the disclosure, Binance issued a warning on November 10 identifying iOS software versions 26.7.1, 27.0.1, and 27.2 as affected. The exchange cautioned that malicious applications could access locally stored information, potentially exposing wallet seed phrases, private keys, and login credentials.

Binance reported no confirmed cryptocurrency thefts linked to worse_query. The exchange advised users to remove applications from untrusted sources, update devices, and transfer assets to a new wallet created on a clean device if credential compromise is suspected.

Key facts

• Apple released iOS 27.2.1 on November 9, addressing nine vulnerabilities across components like AirPlay, Bluetooth, Messages, and App Intents.
• Researcher forcequitOS stated on November 10 that worse_query remains unpatched in iOS 27.2.1 and iOS 27.3 beta 1.
• The vulnerability affects iOS versions 26.0 through 26.7.2 and iOS 27.2.
• Binance issued a security warning on November 10 advising users to remove untrusted applications and secure their credentials.