Researcher Flags iOS Sandbox Flaw Named worse_query
A researcher disclosed a sandbox escape flaw affecting iOS 26 and 27 that could let apps read other apps' data.
Updated on Nov. 11, 2026 in Cybersecurity
Live Poll
Do you trust your phone to keep your private app data safe?
Researcher forcequitOS disclosed a container sandbox escape flaw, named worse_query, affecting iOS 26 and 27. The flaw breaks isolation between apps, potentially allowing an app from an unknown source to read another app's container.
Why it matters
Sensitive information such as a mnemonic, keystore or WebView cache could be at risk if saved in plaintext. SlowMist Chief Information Security Officer im23pds warned that the flaw does not automatically steal assets.
The flaw is a container sandbox escape affecting iOS 26 and iOS 27, enabling an app to access another app's container when installed as an IPA from an unknown source. Whether it has been patched and how widely it is exploitable has not been established.
The players
SlowMist
SlowMist is a blockchain security firm known for auditing cryptocurrency projects and publishing security research.
The details
The worse_query flaw breaks isolation between apps, so an app installed from an unknown source could read another app's container, potentially exposing data such as a mnemonic, keystore or WebView cache if stored in plaintext. The flaw does not automatically steal assets, according to SlowMist's Chief Information Security Officer im23pds.
Timeline
Researcher forcequitOS disclosed the iOS 26 and 27 sandbox flaw on November 11, 2026.
The Tech Race
The worse_query flaw represents a failure of the iOS app sandboxing model, which Apple relies on to keep each app's container isolated from others. Such flaws matter for platforms that depend on sandboxing as their core app security boundary.
iPhone users who install apps from unknown sources could have app data exposed if the flaw is exploited. Users should avoid sideloading IPA files from untrusted origins until an official fix is confirmed.
The takeaway
App isolation on iOS is a core protection, and users who avoid installing apps from unknown sources reduce their exposure to flaws like this one. Keeping devices updated to the latest iOS release is the practical step to take once patches are available.
Further reading
Explore more on Cybersecurity to see how sandbox flaws fit into broader mobile security threats.
Live Poll
Do you trust your phone to keep your private app data safe?
