worse_query Lets iPhone Apps Read Other Apps' Files and Apple's Update Left It Open

One app on an iPhone can now read the files of the other apps on that phone, wallet seed phrases included. iOS 27.2.1 does not fix it. The code is public, and Apple has had the report since October 20.

On an iPhone, each app gets a folder of its own for its data. A wallet app keeps its keys and settings there, a chat app keeps its messages and photos there. Another app on the same phone is not allowed to look inside. That separation between apps is called the sandbox.

On Sunday, November 8, a researcher who goes by forcequit published a way around it on GitHub. He calls it worse_query, and he built it together with a second researcher, 0xjohnny. His project page lists iOS 26.0 up to 26.7.2, and iOS 27.2. Those versions run on the iPhone 11 and later.

It is his second sandbox escape. His earlier one, bad_query, dates from August, and its page lists iOS 26.0 up to 26.6.1 and the fourth beta of iOS 27.0. worse_query is its successor. He announced it on X as a zero-day sandbox escape for iOS 26 and 27, again. A zero-day is a hole the maker has not fixed yet.

The project page of worse_query lists the folders it can reach. The data folders of the apps installed on the phone are on that list. So are the folders of app extensions, the small add-ons such as widgets and keyboards that come with an app. The folders of internal system services are on it, and so are the shared folders that apps use to pass data to each other. On iOS 27 it reaches some system folders on top of that.

It gives an app access to the files of other apps and leaves the rest of the phone untouched. The researcher wrote that it will never be used in a jailbreak tool.

The app that uses it needs one thing: an App Group. Apple’s developer documentation describes App Groups as a way for apps from the same development team to share a folder. A developer switches it on in Xcode, the tool for building iPhone apps.

The phone has a system service that keeps track of the app folders and decides which app may open which one. worse_query talks to that service and comes away with access to folders that belong to other apps. The researcher calls it a logic bug: the service does what it was built to do, in an order its makers did not plan for.

Someone asked him on X whether MIE, Apple’s protection against attacks on the phone’s memory, stops it. His answer was no. MIE guards against memory corruption, a program writing or reading where it should not, and this is a logic bug.

The two researchers found the bug in August. The second researcher wrote that on X on November 10, and the source code agrees: the main file was created on August 20, 2026.

The researcher reported it to Apple on October 20. He later posted a screenshot of the report page, which shows it came in at 10:27 AM that day. Under it is a note from the company. It usually reviews reports within seven days, the note says, but this one was taking longer and had been given priority.

According to the researcher, Apple did not start looking at his report until November 9. That was the day after he made the code public.

On that same day, November 9, Apple released iOS 27.2.1 and iOS 26.7.3. The security notes list nine fixes in 27.2.1 and eight in 26.7.3. They cover Bluetooth pairing, AirPlay, iMessage group chats and a compression library.

One fix in 27.2.1 sounds close. It is a flaw in a part of iOS called App Intents, and through it an app may be able to access sensitive user data. Apple credits that one to a different researcher, László Várady, and the notes for 26.7.3 do not have it at all. The words sandbox and App Group do not appear in either set of notes.

On November 10 the researcher behind worse_query wrote on X that it is not patched in iOS 27.2.1. It is not patched in the first beta of iOS 27.3 either. He added that he will update the version list on the project page as soon as it is patched.

On the iOS 27.3 beta it works as well. A developer named Christoph Kolbicz built a file manager on top of worse_query, called WQ Files. Its page lists iOS 27.2.1 as tested. It can browse the folders of other apps, back them up, edit files in them and empty them.

A user running iOS 27.3 beta, build 24C5037i, posted the app’s own log on the file manager’s page when something went wrong. He reported that the cache cleaner did not work. The developer found that the app could not tell which folder belonged to which app. The log itself shows something else: access to other apps’ folders, okay. Sandbox access, okay. The scan found 292 apps, 1,134 extensions and 34 system services, and checked 1,426 folders. The developer added 27.3 to the versions it was tested on.

People install it through AltStore or SideStore, tools that put apps on an iPhone outside the App Store. That is called sideloading.

The researcher himself wrote on X on November 8 that he is not releasing anything for end users. His project page calls the code a proof of concept for developers, a demo that shows the hole exists. It is not useful by itself, the page says. Within days, someone else had built a ready-made app for end users on top of it.

He had not planned to publish worse_query at all. On X he explained that several people had found the same bug on their own months earlier, and someone else had already shown it in public. So he released his own version first. In that same thread he warned against releasing zero-days without telling the maker first and agreeing on a date. Especially, he wrote, when they can easily be used for spyware.

His partner put it plainly on November 10: there is no iOS update that fixes it.

Publishing early may have cost the researcher money. Apple pays researchers through its Security Bounty program. The category for a malicious app on iPhone that escapes the sandbox and gets sensitive user data lists 100,000 dollars. The rules of that program also say that a researcher who makes a hole public before a fix is out gets no reward at all. He wrote that he does not mind losing a possible bounty, because Apple was stalling on his report. On November 11 he wrote that Apple was finally investigating it.

On November 10, the crypto exchange Binance posted a warning on X. A malicious app could read local files from other apps, and that put seed phrases, private keys and login credentials at risk. A seed phrase is the list of words that restores a crypto wallet, and whoever has those words has the wallet. The post was viewed 3.8 million times.

The exchange named three versions: iOS 26.7.1, 27.0.1 and 27.2. Those three are not the limit. The researcher’s own range is wider, and the file manager’s log shows it on 27.3 beta.

The exchange’s advice was to delete apps from untrusted sources and to update iOS and the apps on the phone. Deleting unknown apps helps. Updating does not, yet. The second researcher wrote on X that Apple has not patched the bug, that the exchange meant well, and that updating alone will not fix it.

For iOS 26.7.3 the picture is not clear. The researcher’s range stops at 26.7.2 and the file manager asks for 26.7.2 or lower. No public test on 26.7.3 has shown up, and the notes for that release say nothing about the sandbox.

The warning was about apps from outside the App Store. The researcher went further. On November 10 he wrote that worse_query would absolutely be exploitable from an App Store app. An attacker would only have to get through App Review. His partner was more careful: unlikely, but there is a risk that an approved app packs this and gets past the review.

App Review is the check Apple runs before an app goes into the store. Rule 2.5.1 of its guidelines says apps may only use public APIs, the functions Apple offers to developers. worse_query calls functions the company keeps for itself, and that is the kind of thing the review is supposed to catch. Rule 2.5.2 says an app may not read or write data outside its own folder. That is exactly what worse_query does.

The review has missed a sandbox escape before, two months ago.

In September, an app called FomoPeek went through the App Store with a sandbox escape inside. The researcher pointed to it himself on X. The analysis came from SlowMist, a blockchain security firm, together with the security team of OKX. The app presented itself as a read-only tool for watching crypto wallets, and it never asked for a seed phrase.

Version 1.0 went live on August 29 and was clean. Version 1.1 arrived on September 9 with two hidden modules, and version 1.2 kept them on September 12. Those carried eight kernel exploits. The kernel is the core of the operating system. The modules also held code to escape the sandbox and code to decrypt the iPhone’s Keychain, where iOS stores passwords and keys. Version 1.3, on September 17, removed both modules again.

The modules came through the official App Store and carried the same developer signature as the app. To get people to install it, the promotion offered 5 to 7 USDT, a cryptocurrency tied to the US dollar. Users had to sign up with a referral code and keep the app open on a physical iPhone for several minutes. The App Store page said Data Not Collected.

The operators steered the app from a distance through a control server. The attack had an on and off switch on that server. In the researchers’ captures it was switched off. According to the analysis, the operators could turn it on or off and change how often it ran, without a new version of the app. The address of that server sat encrypted in a public file on Bitbucket, a site for hosting code. One edit to that file moved the app to another server. What the app did could change after it was in the store, without a new version going through review.

In their test, the researchers flipped that switch on inside the app on their own isolated test device. The server then sent a list of 19 targets, almost all of them wallet apps, including MetaMask, Trust Wallet, OKX Wallet and SafePal. The folder of Apple Notes was on the list too. The researchers watched the app pack up the notes database and upload it. The attacker’s main wallet address received 579,984.34 USDT.

The app used older kernel exploits that reached up to iOS 26.1. worse_query is a different hole. The case shows that a sandbox escape has already passed the review once, in a crypto app that looked harmless.

On November 12 the researcher put it in proportion himself. App Review does mess up rather often, he wrote. A malicious App Store app could be dangerous, and so could an update to an app that was fine before. He added that it is realistically not something to worry about. He also pointed at a second route. Someone could combine worse_query with a second bug that runs code inside an app that already has an App Group, such as a third-party app. Then no sideloading is needed at all.

So far neither the exchange nor the researchers have reported an attack that used worse_query, and no theft has been linked to it. Apple has not said anything. That is its policy: the company does not comment on security issues until it has investigated them and a fix is out.

What you can do on your own iPhone:

• → Check your version under Settings, General, About, and install the next iOS update as soon as it comes
• → Do not install apps from outside the App Store, such as sideloaded or self-signed IPA files, the install files for iPhone apps, from people you do not know
• → Be careful with new App Store apps from unknown developers, especially crypto tools that pay you to install them and keep them open
• → Keep your seed phrase off the phone: not in Notes and not as a screenshot
• → Think a wallet on your iPhone was exposed? Create a new wallet with a new seed phrase on a different device, move your funds there, and sign out of your active login sessions

Want to see how a program reaches files it was never meant to read, on a Linux machine in your own lab? My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

worse_query on GitHub | Apple iOS 27.2.1 security content | SlowMist FomoPeek analysis