@imTokenCN
Pinned post
🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨View quoted post on X
A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱
⚠️ This is a container sandbox escape, not a jailbreak. It breaks the assumption that apps can’t see each other: a malicious app that successfully exploits it can reach system paths and read or modify other apps’ data.
💸 The bug does not steal assets by itself. The real risk starts when a user installs an app from an untrusted source, such as a sideloaded IPA. If a wallet stores its seed phrase, keystore or WebView cache in plaintext locally, a malicious app could read it.
🛡️ Recommendations:
🔸 Don’t install IPAs or apps from unknown sources
🔸 Keep iOS up to date and install Apple’s fix as soon as one is released
🔸 Wallet developers: don’t store sensitive data in plaintext locally
🔸 If you installed an untrusted app on a device holding wallets, treat it as risky and consider moving assets to a new wallet created on a clean device
🔗 github.com/forcequitOS/wo…
🎉 imToken × Lido 质押加息活动正式开启！
$10,000 加息奖励，等你来瓜分！
通过 imToken Stake 质押 ETH，享 @LidoFinance 原生质押收益 + 额外加息奖励！
动态加息，越早参与，越早享受更高 APY！
活动截止：12 月 9 日 16:00（UTC+8）
立即参与：web.token.im/function/stake…View quoted post on X
We’re aware of a security issue affecting Web3Auth’s services used by some third parties.View quoted post on X
We have temporarily paused the embedded wallet service. After an initial investigation, we’ve found no evidence that MetaMask users are impacted.
