Researcher Says Apple’s iOS 27.2.1 Did Not Fix Reported Wallet-Security Flaw
Apple’s November 9, 2026, iOS 27.2.1 update lists nine security fixes, but says nothing about a separate iOS flaw called worse_query. Researcher forcequitOS said the flaw remained active after the update. Reports disagree about which versions are affected, and Binance has not confirmed any crypto theft linked to it.
- Apple’s advisory lists nine fixes but does not mention worse_query.
- forcequitOS said the flaw persisted in iOS 27.2.1 and iOS 27.3 beta 1.
- Binance reported no confirmed theft tied to the flaw and advised users to take precautions.
- Reports conflict on affected versions, and exposure of wallet secrets has not been established.
What the reported flaw could do
worse_query is described as a weakness in iOS protections for app data. Those protections are meant to stop one app from freely reading another app’s files. A proof of concept reportedly shows access to data containers belonging to some other apps, as well as certain system directories. That points to a possible privacy risk, but does not show that the technique gives unrestricted access to an iPhone.
The reported technique uses an App Group, an Apple feature that lets apps with the required entitlement share a data container. Available descriptions say an app using the technique must be configured with an App Group container. They do not explain exactly how an attacker would get such an app onto a device or whether the user would need to take any action.
forcequitOS described worse_query as a successor to an earlier vulnerability called bad_query. The original exploit code was described as a developer tool that needed extra setup. Reporting on WQ Files, an app developed by Christoph Kolbicz, says it can browse, export, modify and delete files belonging to other apps without a jailbreak. Those reported capabilities do not show that any ordinary app can rummage through an iPhone at will.
Apple’s update fixes nine other listed issues
Apple released iOS 27.2.1 for iPhone 11 and newer models, along with supported iPads. Its security advisory lists nine vulnerabilities affecting AirPlay, App Intents, Bluetooth, brotli, CoreUtils, Messages and rapportd. worse_query is not among them.
One documented fix addresses an App Intents authorization issue that could let an app access sensitive user information. Apple identifies it as CVE-2026-113963, credits László Várady with discovering it, and says it fixed the issue with improved state management. Other fixes address Bluetooth and pairing weaknesses, memory corruption caused by specially crafted brotli input, and two Messages flaws that involved unauthorized access to group messages.
The App Intents issue is a separate vulnerability. Apple’s advisory does not link it to worse_query. The advisory’s silence means Apple has not publicly listed worse_query among the fixes, but it does not show whether the update included an indirect or undisclosed mitigation.
On November 10, forcequitOS said the flaw was “not patched in iOS 27.2.1 and 27.3 beta 1”. That is the researcher’s assessment, not a statement from Apple.
Wallet exposure is possible, not proven universal
A wallet’s recovery phrase, also called a seed phrase, can restore access to funds. A private key controls the funds associated with a wallet. If worse_query can reach a location where sensitive wallet data is stored, the consequences could be serious.
But access to some app files does not prove the technique can extract every wallet’s recovery phrase or private key. Wallets may use encryption, app-specific protections, or system tools such as Keychain or Secure Enclave to protect sensitive data. The available information does not show whether worse_query can bypass those protections or access secrets stored there.
Binance warned users on November 10 and reportedly said it had identified no confirmed cryptocurrency theft linked to worse_query. That is useful, but limited: it describes the confirmed cases known to the exchange, not proof that no exploitation has taken place.
The affected iOS versions remain unclear
Reports list different affected versions. forcequitOS said the flaw remained active in iOS 27.2.1 and iOS 27.3 beta 1. The project’s GitHub repository reportedly lists iOS 26.0 through 26.7.2 and iOS 27.2. Binance’s warning reportedly named iOS 26.7.1, 27.0.1 and 27.2.
The repository list, as reported, does not include iOS 27.2.1, even though forcequitOS says that version remains vulnerable. The available information does not explain the difference or establish whether each list covers tested versions, versions believed to be vulnerable, or versions confirmed as exploitable. There is no sound basis for giving one definitive list.
What iPhone crypto users can do
Binance warned users to remove apps from untrusted sources, including sideloaded or manually signed IPA files, and install the latest official versions of iOS and their apps. Those updates address known issues, but forcequitOS’s assessment means users should not assume iOS 27.2.1 fixes worse_query.
If you have a specific reason to think your wallet credentials were exposed, Binance recommended moving assets to a new wallet created on a clean device and resetting active login sessions. Create the new wallet with a fresh recovery phrase on a trusted device. Do not import the potentially exposed phrase. Reset sessions for relevant exchange accounts or other services where that option is available.
Key questions and answers
-
Does iOS 27.2.1 fix worse_query?
Apple’s advisory does not list the flaw. forcequitOS said it remained active in that version, but conflicting reports about affected versions have not been resolved. -
Are iPhone wallet recovery phrases confirmed exposed?
No. The reported file access creates a potential risk, but the available information does not show that the flaw can extract every wallet’s secrets or bypass each wallet’s protections. -
Has Binance confirmed theft linked to the flaw?
No. Binance reportedly said it had identified no confirmed cryptocurrency theft associated with worse_query. -
What should users do if they suspect exposure?
Follow Binance’s advice: remove untrusted apps, keep official software current, and move funds to a wallet with a freshly generated recovery phrase on a clean, trusted device. Reset relevant active account sessions where possible.
Caution makes sense, but panic does not. Avoid untrusted apps and keep devices updated. Apple’s nine listed fixes do not settle the separate questions around worse_query. The flaw’s precise reach, affected versions and any future Apple fix remain unclear.
