Apple's latest iOS 27.2.1 release still leaves the worst_query flaw open, exposing users' private keys and recovery phrases to potential theft.
Yesterday Apple rolled out iOS 27.2.1, a day after the exploit code appeared on GitHub, but the security update does not address the worst_query sandbox bypass.
The vulnerability affects iOS versions from 26.0 up to 27.2, allowing malicious apps to break Apple's app sandbox and access other apps' data containers, including cryptocurrency wallet files.
Binance warned iPhone users on November 10 that the flaw puts locally stored seed phrases and private keys at risk, urging caution with third-party wallet apps.
The researcher forcequitOS confirmed the bug remains live in iOS 27.2.1 and the upcoming iOS 27.3 beta, and pledged to update the proof-of-concept once Apple provides a fix.
Apple's advisory lists nine other fixes for AirPlay, Bluetooth, Messages and related components, but none target the worst_query weakness.