🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨 A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱 ⚠️ This is a container sandbox escape, not a jailbreak. It breaks the assumption that apps can’t see each other: a malicious app that successfully exploits it can reach system paths and read or modify other apps’ data. 💸 The bug does not steal assets by itself. The real risk starts when a user installs an app from an untrusted source, such as a sideloaded IPA. If a wallet stores its seed phrase, keystore or WebView cache in plaintext locally, a malicious app could read it. 🛡️ Recommendations: 🔸 Don’t install IPAs or apps from unknown sources 🔸 Keep iOS up to date and install Apple’s fix as soon as one is released 🔸 Wallet developers: don’t store sensitive data in plaintext locally 🔸 If you installed an untrusted app on a device holding wallets, treat it as risky and consider moving assets to a new wallet created on a clean device 🔗