SlowMist flags iOS sandbox escape that could leak plaintext wallet secrets

Blockchain security firm SlowMist put crypto users on notice Nov. 10: a freshly published iOS sandbox-escape proof of concept could let a malicious app reach into other apps' data, according to thedefiant.io. The tool, called worse_query, was introduced by researcher forcequitOS on Nov. 8, who credited collaboration with @0xjohnny. Its GitHub repository lists iOS 26.0 through 26.7.2 and iOS 27.2 as affected versions.

SlowMist was careful about the threat model. The bug doesn't steal assets on its own, the firm said. It requires a user to install and run an untrusted app, such as a sideloaded one, and for that app to successfully exploit the flaw. If that happens, a wallet's seed phrase, keystore or embedded-browser cache could be readable when stored locally in plaintext. SlowMist's guidance for wallet developers was blunt: don't store sensitive data unencrypted.

Apple's security documentation describes third-party apps as isolated in sandboxes meant to stop them from gathering or modifying other apps' information. Worse_query goes after that separation. Its README lists access to app-data and shared app-group containers, plus certain system containers on iOS 27. Mechanically, the code redirects a cache folder inside an app-controlled shared container to another location, then requests a file-access permission token through iOS's container-management service. An App Group container is required.

The researcher frames worse_query as a developer proof of concept that isn't useful by itself, and the README explicitly states the work has nothing to do with a jailbreak. It's billed as the direct successor to bad_query, an earlier project that listed iOS 26.0 through 26.6.1 and iOS 27.0 beta 4, giving the new release claimed reach into later builds.

Timing matters here. Apple shipped iOS 27.2.1 and iOS 26.7.3 on Nov. 9, but neither security advisory names worse_query or confirms a fix for the proof of concept, and the mere availability of those updates doesn't establish that they block it.

For users who already ran an untrusted app on a device holding wallets, SlowMist's advice is to consider moving assets to a new wallet created on a clean device — alongside the usual hygiene of avoiding apps from unknown sources and keeping iOS current.