forcequit

I make stuff, sometimes iOS jailbreak related.
Follow along for updates...

[forcequit @forcequitOS]

Introducing bad_query, a zero-day sandbox escape PoC for iOS 26 and 27.
This bug has been patched earlier today in iOS 27.0 beta 5, but not 26.6.1. Be careful out there, and use this for good.
Coordinated release with @0xjohnny and @rooootdev :p
https://t.co/UYYpqH37w6

[forcequit @forcequitOS]

@Zidapi @0xjohnny @rooootdev App bundles != app data
bad_query can access app data containers on both iOS 26 and iOS 27

[forcequit @forcequitOS]

Introducing bad_query, a zero-day sandbox escape PoC for iOS 26 and 27.
This bug has been patched earlier today in iOS 27.0 beta 5, but not 26.6.1. Be careful out there, and use this for good.
Coordinated release with @0xjohnny and @rooootdev :p
https://t.co/UYYpqH37w6

[forcequit @forcequitOS]

@sdw4938 @0xjohnny @rooootdev No, those aren't in a container.

[forcequit @forcequitOS]

@DerClown03 @0xjohnny @rooootdev It can’t do anything for a regional restriction

[forcequit @forcequitOS]

@jordrixx @0xjohnny @rooootdev Build 24A5408d patches it
I don't keep up with the public beta cycle
The public beta released yesterday patches it

[forcequit @forcequitOS]

@adapt164850 @rooootdev It cannot be
Nothing can really bypass it except for SpringBoard tweak injection which this is very far from

[forcequit @forcequitOS]

@famksm_ @0xjohnny @rooootdev No, not in its current state at the very least.

[forcequit @forcequitOS]

@RuizheFan @0xjohnny @rooootdev (Loses data unless you make a backup with a computer then modify it to restore on 27.0b4)

[forcequit @forcequitOS]

@RuizheFan @FurtherLucky @rooootdev Download an IPSW for beta 4 and restore it with a computer

[forcequit @forcequitOS]

@RuizheFan @FurtherLucky @rooootdev Download an IPSW for beta 4 and restore it with a computer

[forcequit @forcequitOS]

@binghuojun365 @0xjohnny @rooootdev bad_query only has partial support for iOS 26 and that doesn’t include System(Group) containers or MobileGestalt

[forcequit @forcequitOS]

@Mtz939479 @0xjohnny @rooootdev This is probably the first and last 0day I’m ever releasing, and I don’t have a crystal ball
In the context of bad_query at least, 26.6 is supported equally to 26.2, so you can update to 26.6 fine for that ¯\_(ツ)_/¯

[forcequit @forcequitOS]

@LegiteriumZ @0xjohnny @rooootdev MobileGestalt editing does not work on iOS 26
bad_query only has partial support for iOS 26, and it happens to exclude system and systemgroup containers (which the MobileGestalt cache is)

[forcequit @forcequitOS]

@FurtherLucky @rooootdev Best go back to beta 4 while you can.

[forcequit @forcequitOS]

@AmotoAaron8713 @0xjohnny @rooootdev This exploit is not useful for a jailbreak at all and never will be.

[forcequit @forcequitOS]

@MinecraftHDPL @0xjohnny @rooootdev @khanhduytran0 It can’t be used to write mis.db, this only gives r/w on containers, not all of /var unfortunately

[forcequit @forcequitOS]

@MchinaMd57764 nice bug

[forcequit @forcequitOS]

@oxj_n @SzeMttrs @0xjohnny @rooootdev Not supported right now

[forcequit @forcequitOS]

@Mtz939479 @0xjohnny @rooootdev If you want better stability you can go to iOS 26.6 but it doesn’t really matter, bad_query is supported the same on both

[forcequit @forcequitOS]

@LegiteriumZ @0xjohnny @rooootdev You don’t really have to update
If you want to do MobileGestalt stuff, iOS 27.0b4
If you don’t want an annoying popup every time you unlock your phone by November, iOS 26.6, just know that iOS 26 support is partial

[forcequit @forcequitOS]

@Bb09167265 @0xjohnny @rooootdev You can update to 27.0 beta 4 still while it's signed by downloading an IPSW for it and installing it using a computer (Shift + Check For Updates... on Windows, Option + Check for Updates... on macOS)

[forcequit @forcequitOS]

@Ashley62312 @0xjohnny @rooootdev Untested thus far