What is this?
badquery is a proof-of-concept sandbox escape for iOS 26 and 27, written in C — code that demonstrates breaking out of the iOS app sandbox.
badquery is a proof-of-concept sandbox escape for iOS 26 and 27, written in C — code that demonstrates breaking out of the iOS app sandbox.Is this a jailbreak I can install on my iPhone?No — the author is explicit that it is just a proof-of-concept for developers and not anything meaningfully usable at the moment. Think demonstration, not tool.
No — the author is explicit that it is just a proof-of-concept for developers and not anything meaningfully usable at the moment. Think demonstration, not tool.How do I build and run it?No build or run steps are documented: the repo is plain C with no Makefile, scripts, or dependency manifest, so reproducing it means reading and compiling the sources yourself.
No build or run steps are documented: the repo is plain C with no Makefile, scripts, or dependency manifest, so reproducing it means reading and compiling the sources yourself.Which iOS versions does it cover?iOS 26.0 through 26.6.1, plus the 27.0 beta 4. The author adds that iOS 18 might work too, but he has not tested that at all — your mileage may vary.
iOS 26.0 through 26.6.1, plus the 27.0 beta 4. The author adds that iOS 18 might work too, but he has not tested that at all — your mileage may vary.What can badquery actually reach once it escapes the sandbox?Filesystem paths outside the app sandbox: the README names the specific paths badquery can access, which is the concrete payoff of the escape.
Filesystem paths outside the app sandbox: the README names the specific paths badquery can access, which is the concrete payoff of the escape.Can I reuse the code in my own project?Probably not without permission — the repo ships no license, so the code stays under the author's exclusive copyright by default. Reading and learning from it is fine.
Probably not without permission — the repo ships no license, so the code stays under the author's exclusive copyright by default. Reading and learning from it is fine.What are similar projects?FilzaSlop, dirtyfrag, skitter-creek-bath-salts, exploitarium, badnotes, Relapse-Exploit, Erosion, copy-fail-CVE-2026-31431
FilzaSlop, dirtyfrag, skitter-creek-bath-salts, exploitarium, badnotes, Relapse-Exploit, Erosion, copy-fail-CVE-2026-31431Which topics is it in?poc, mobile-security, exploit-development, security-research, infosec, vulnerability, exploit, low-level, hacking, sandbox, apple, c
poc, mobile-security, exploit-development, security-research, infosec, vulnerability, exploit, low-level, hacking, sandbox, apple, c