Apple’s iOS 27.2.1 update leaves crypto wallet security flaw unpatched

Apple’s latest iOS 27.2.1 security update has reportedly failed to patch the worse_query vulnerability that could expose cryptocurrency wallet credentials, despite addressing nine other security flaws.

The researcher behind the exploit, known as forcequitOS, said on November 10 that the vulnerability remained active in both iOS 27.2.1 and the first beta of iOS 27.3, contradicting suggestions that Apple’s latest update had resolved the problem.

Apple released iOS 27.2.1 on November 9, a day after the researcher published the exploit’s source code on GitHub. Its official security notes list fixes for several components, but do not mention worse_query.

The disclosure has raised concerns among cryptocurrency users after Binance warned that malicious applications could exploit the vulnerability to access sensitive files belonging to other apps, potentially exposing private keys and wallet recovery phrases.

Researcher says worse_query remains unpatched in iOS 27.2.1

In a November 10 statement on X, forcequitOS directly addressed confusion surrounding the vulnerability’s status following Apple’s latest software release.

The researcher said worse_query was “not patched in iOS 27.2.1 and 27.3 beta 1” and promised to update the project’s documentation once Apple released a working fix.

According to the GitHub repository, the exploit affects iOS versions 26.0 through 26.7.2 and iOS 27.2. The developer described it as a successor to an earlier vulnerability called bad_query.

Worse_query targets Apple’s application sandbox, which normally restricts each app’s access to its own files and prevents unauthorized access to information stored by other applications.

The published proof of concept demonstrates how an application can bypass those restrictions and reach data containers belonging to unrelated apps, including shared application groups and certain system directories.

Although the researcher described the original code as a developer tool that cannot be used independently without additional setup, other developers have since built applications capable of using the technique.

One example is WQ Files, developed by Christoph Kolbicz, which allows users to browse, export, modify, and delete files belonging to other applications without jailbreaking an iPhone.

Apple’s security update addresses nine separate vulnerabilities

According to Apple’s official security advisory, iOS 27.2.1 addresses nine vulnerabilities affecting AirPlay, Bluetooth, Messages, App Intents, Brotli, CoreUtils, and rapportd.

Among the fixes is CVE-2026-113963, an authorization vulnerability in App Intents that could allow applications to access sensitive user information.

Apple credited security researcher László Várady with discovering the issue and said it had resolved the problem through improved state management.

Although the vulnerability concerns unauthorized access to sensitive information, Apple’s documentation identifies a different affected component from the App Group mechanism used by worse_query.

The update addresses two Messages vulnerabilities, including one that could allow a remote attacker to join an iMessage group conversation and receive messages without authorization.

Another flaw could allow newly added participants to access messages sent before they joined a conversation.

Other patches address Bluetooth pairing weaknesses and a Brotli memory corruption vulnerability caused by specially crafted input.

Apple made the update available for iPhone 11 and newer models, alongside supported iPads.

Binance warns crypto wallets could be exposed

The researcher’s statement followed a November 10 warning from Binance, which identified iOS 26.7.1, 27.0.1, and 27.2 among the affected software versions.

As previously reported by crypto.news, the exchange warned that malicious applications could access locally stored information belonging to other apps, potentially exposing wallet seed phrases, private keys, and login credentials.

A Binance spokesperson said the exchange had not identified any confirmed cryptocurrency theft linked to worse_query.

The exchange advised users to remove applications installed from untrusted sources, including sideloaded or manually signed IPA files, and update their devices and applications to the latest official versions.

For users who suspect their credentials have already been compromised, Binance recommended transferring assets to a new wallet created on a clean device and resetting active login sessions.

The warning specifically concerns applications capable of exploiting the sandbox vulnerability. The published exploit requires an application configured with an App Group container, meaning the technique does not independently compromise an iPhone through ordinary website browsing.

Binance’s recommendations therefore extend beyond installing Apple’s latest software update, with the exchange urging users to avoid unauthorized application packages while the vulnerability remains a concern.