Apple released iOS 27.2.1 on November 9, 2026, addressing nine security vulnerabilities. However, the update has not resolved a separate sandbox-escape flaw known as “worse_query,” according to the researcher who published the proof-of-concept, leaving cryptocurrency wallet credentials potentially exposed on affected devices.
The vulnerability allows a malicious app to bypass iOS sandbox restrictions and read local files belonging to other applications. This could expose seed phrases, private keys, and login credentials stored by crypto wallet apps. Binance issued a warning on November 10 highlighting the risk for users on iOS 26.7.1, 27.0.1, and 27.2. The researcher behind the exploit, forcequitOS, stated that the flaw remains active in both iOS 27.2.1 and the first beta of iOS 27.3.
Apple’s security notes for the 27.2.1 release list fixes for issues in Messages, Bluetooth, AirPlay, and other components but do not mention worse_query by name, and the company has not confirmed whether the update closes the sandbox escape.
The Drivers of the Current Situation
The main issue is the persistence of the worse_query sandbox vulnerability after Apple’s November 9 security update. Confirmed elements include the release of iOS 27.2.1 patching nine other flaws, Binance’s subsequent alert about the risk to wallet credentials, the researcher’s public statement that the bug is unpatched in 27.2.1 and 27.3 beta 1, and the absence of any official Apple confirmation that the specific flaw has been fixed. Related factors include the public availability of the proof-of-concept code, the dependence of exposure on how individual wallet apps store data, and the lack of confirmed thefts linked to the vulnerability so far.
Subsequent Apple security notes, researcher updates, or reports of exploitation will determine whether the flaw is closed and the practical risk to users.
Impact and Broader Context
The situation has focused attention on the residual risk for iPhone users who store crypto assets in software wallets, the limits of relying solely on OS updates for protection, the importance of avoiding untrusted or sideloaded apps, the comparative safety of hardware wallets that keep keys offline, and the challenges of rapid disclosure and patching cycles when critical flaws affect high-value targets such as seed phrases. Coverage distinguishes between the nine issues Apple explicitly fixed and the unconfirmed status of the sandbox escape that could affect wallet data.
Further clarification from Apple, additional researcher testing, or any confirmed incidents will shape the near-term security posture for mobile crypto users.
Conclusion
While iOS 27.2.1 strengthens protections against several known threats, the continued presence of the worse_query sandbox flaw—according to the researcher who disclosed it—means that users storing seed phrases or keys on affected iPhones still face potential exposure from malicious apps. Until Apple confirms a fix or ships a subsequent update that demonstrably closes the vulnerability, caution around app sources and consideration of hardware wallets remain prudent measures.
This analysis draws from Apple’s November 9 security release notes, Binance’s November 10 advisory, statements from the forcequitOS researcher, and contemporaneous reporting. The exact patch status of worse_query, any future Apple response, and the absence or emergence of real-world exploitation remain subject to further technical verification and official updates.