POPA ReconHow it investigates

iOS sandbox escape PoC disclosed, malicious apps can read other apps files

It needs the user to install and launch the malicious app, it is not automatic theft.

Delete apps from untrusted sources, update iOS and apps to latest official versions.

First reported Nov 10, 2026, 06:58 UTC

Source reports

  • ⚠️ iOS sandbox escape 0-day PoC "worse_query" disclosed; untrusted apps could read plaintext wallet seeds Source — ahboyashreads, Nov 10, 2026, 06:58 UTC
  • ⚠️ iOS sandbox escape 0-day PoC "worse_query" disclosed; untrusted apps could read plaintext wallet seeds Source — Rickler Feed, Nov 10, 2026, 06:59 UTC
  • Binance и SlowMist предупредили об уязвимости iOS: вредоносные приложения могут получить доступ к данным криптокошельков Исследователи безопасности обнаружили уязвимость worse_query, позволяющую приложениям на iPhone обходить ограничения iOS Sandbox и читать локальные файлы… — BredoStrategy, Nov 10, 2026, 10:43 UTC
  • ⚠️ Binance предупреждает об уязвимости iOS, которая может раскрыть seed-фразы и приватные ключи Уязвимость Worse_Query затрагивает iOS 26.7.1, 27.0.1 и 27.2. Она позволяет вредоносным приложениям читать локальные файлы других программ, потенциально получая доступ к seed-фразам… — Закрепи.sender, Nov 10, 2026, 10:44 UTC
  • iPhone iOS update a Binance warns of a 'worse_query' vulnerability in iOS versions 26.7.1, 27.0.1 and 27.2, which could allow malicious apps to read local files (seed syntax, private keys, etc.) from other apps. This is an iOS-level sandbox escape vulnerability, which can be… — Korean Alpha EN, Nov 10, 2026, 11:02 UTC
  • #Security #SelfCustody #Binance #Apple 🛡 worse_query: an iOS sandbox escape that reaches your crypto keys The worse_query vulnerability bypasses iOS app isolation and gives malicious apps read access to files from any other app - seed phrases, private keys, session data… — Korean Alpha EN, Nov 10, 2026, 12:24 UTC

Excerpts are quoted from the linked sources, which own their text.

POPA Recon's research of this event

POPA Recon's research of this event

All news events

Ask your own