forcequitOS/worse_query

What it is

worse_query is a proof-of-concept sandbox escape covering iOS 26.0 through 26.7.2 and 27.2, and the successor to the earlier bad_query. It is built for developers and is not useful on its own.

The project is not a jailbreak and its author explicitly states it will never be one, warning against presenting it as such. Its value is showing which filesystem locations an app can reach after the escape.

Reachable paths

On the listed iOS versions, worse_query provides access to:

/var/containers/Data/System (iOS 27)
/var/containers/Shared/SystemGroup/* (iOS 27)
/var/mobile/Containers/Data/Application/*
/var/mobile/Containers/Data/InternalDaemon/*
/var/mobile/Containers/Data/PluginKitPlugin/*
/var/mobile/Containers/Shared/AppGroup/*
/var/mobile/Containers/Shared/AppGroup (iOS 27)

Getting started

worse_query is integrated into an app, not run as a standalone tool. The documented prerequisite is to set up an App Group container for your app; only then can worse_query be used. The README does not include build steps, an API surface, or a sample project, so the practical starting point is to configure an App Group capability in your Xcode target, add the project to your app, and test access against the paths above on a matching iOS version.

Constraints

• Only the iOS 26.0–26.7.2 and 27.2 ranges are stated as supported.
• An App Group container must be configured in your app for use.
• It is a developer proof-of-concept, not an end-user utility, and not a jailbreak.
• The project is licensed under GPL-3.0.

HotRepo's take

worse_query is a very new repository, created on 2026-11-08, and it entered HotRepo's new-project list on 2026-11-09 with 143 stars gained in a window of roughly 12 hours, alongside 30 forks. That places it among fast-starters in the security niche, but it is too early to read as sustained adoption, and it has no recorded GitHub daily rank. The author's clear disclaimer that this is not a jailbreak is the most important signal for anyone encountering the project through that spike.