[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiEMF-jMs3zVz3H_ZhZFqwldJapIxGld9SdagmyZPg2M":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"80f1e8e2-53f3-459e-81b3-25d01fab8887","iOS Sandbox Escape Is Public, and Apple Hasn’t Confirmed a Fix","ios-sandbox-escape-is-public-and-apple-hasn-t-confirmed-a-fix-6af97e","A public iOS sandbox escape could expose wallet keys, Binance warns. No attacks are reported and no fix is confirmed. On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps. Seed phrases, private keys and login credentials could be exposed to a malicious […]","A public iOS sandbox escape vulnerability, named 'worse_query', allows malicious apps to read local files from other applications, potentially exposing seed phrases, private keys, and login credentials. The exploit affects iOS versions 26.7.1, 27.0.1, and 27.2. While Apple has released updates, they have not confirmed a fix for this specific issue. No attacks or data theft have been reported by Binance or the researcher who published the proof-of-concept code.","Public iOS sandbox escape 'worse_query' allows apps to read local files, potentially exposing sensitive data.","https:\u002F\u002Fsecurityaffairs.com\u002F202788\u002Fhacking\u002Fios-sandbox-escape-is-public-and-apple-hasnt-confirmed-a-fix.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2021\u002F03\u002Fapple.jpg","2026-11-10T15:46:20+00:00","2026-11-10T17:00:27.613482+00:00",8,[17,20,23],{"name":18,"type":19},"iOS","product",{"name":21,"type":22},"Apple","vendor",{"name":24,"type":22},"Binance","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,18],{"controls":41,"vendors":120},[42,71,92],{"slug":43,"name":44,"problem":45,"products":46},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":72,"name":73,"problem":74,"products":75},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[76,84],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":37,"name":93,"problem":94,"products":95},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[121],{"slug":122,"name":21,"logo_path":123,"roles":124},"apple","\u002Fvendor-logos\u002Fapple.png",[125],"affected",{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":136},"unconfirmed-ios-sandbox-escape-leaves-sensitive-app-data-exposed","Unconfirmed iOS Sandbox Escape Leaves Sensitive App Data Exposed","A publicly disclosed iOS sandbox escape vulnerability, dubbed 'worse_query', allows malicious applications to read files belonging to other apps, potentially exposing cryptocurrency seed phrases, private keys, and login credentials. The core problem is that a proof-of-concept exploit is publicly available while Apple has not confirmed whether its recent updates actually address the flaw, leaving users in an ambiguous security state. This matters because attackers can weaponize public exploit code quickly, and the absence of vendor confirmation makes it impossible for defenders to know whether patching resolves the risk. Organizations and individuals relying on iOS devices to store sensitive financial or identity data face elevated exposure until Apple explicitly validates a fix.",[131,132,133,134,135],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented","NIS2 Article 21(2)(e)","OWASP A01:2021 Broken Access Control",{"NIS2 Article 21(2)(e)":137,"OWASP A01:2021 Broken Access Control":138,"NIST SP 800-53 SI-2: Flaw Remediation":139,"CIS Control 7: Continuous Vulnerability Management (v8)":140,"NIST CSF 2.0 ID.RA-1: Asset vulnerabilities are identified and documented":141},"This point covers vulnerability handling and disclosure in acquisition, development, and maintenance; Apple's lack of a confirmed fix or disclosure statement for a publicly exploited vulnerability is precisely the gap this provision requires entities and their software suppliers to address.","The sandbox escape allows one application to access files belonging to another, which is a form of broken access control at the operating system level that OWASP A01 addresses by requiring strict enforcement of access boundaries.","SI-2 requires vendors and organizations to identify, report, and correct information system flaws; Apple's failure to confirm whether updates remediate this specific sandbox escape is a gap in the flaw remediation lifecycle this control addresses.","CIS Control 7 requires organizations to continuously track and remediate vulnerabilities; the ambiguity around whether Apple's updates fix 'worse_query' highlights the need for a process to monitor vendor confirmation and assess residual risk when patches are unverified.","This category requires that vulnerabilities in assets be identified and documented, which organizations cannot fully do for iOS devices when the vendor has not confirmed the vulnerability's patch status."]