If you keep a crypto wallet or banking app on an iPhone, the thing to check this week is where your other apps came from. A public exploit named worse_query breaks the walls between iOS apps, and its author says iOS 27.2.1, which Apple shipped on 9 November, does not close it.
The exploit was released on 8 November by a developer known as forcequit, with help from 0xjohnny. Their description is a zero-day that escapes the iOS sandbox, the layer that stops one app from touching another’s data. On 10 November forcequit said the 27.2.1 release and the first iOS 27.3 beta both still carry the hole.
Binance, the crypto exchange, issued a warning the same day. Its worry is data that other apps keep on the phone, such as wallet recovery phrases and saved sign-ins, and it points out that the weakness lies in iOS rather than in its own app. It lists releases from iOS 26.7.1 to 27.2 as affected.
Its checklist is short. Uninstall apps that did not come from the App Store, for instance sideloaded or self-signed ones, and update iOS and every app. Anyone who fears a theft should set up a fresh wallet on a clean device, send funds across and sign out of every session.
The bigger question is whether the App Store is a safe barrier. The released code only works if an app sets up an App Group container, and the author calls it a proof of concept for developers, not an attack tool on its own. But forcequit says an App Store app could use it too, provided it got through App Review, and he pointed to an earlier app that reached the store carrying several known flaws.
Forcequit says he will change the project’s readme once Apple patches it, which makes the next iOS point release the one to watch.
