Binance warned iPhone users about worse_query, an iOS flaw that could let malicious apps read files belonging to other apps. The warning named iOS 26.7.1, 27.0.1, and 27.2 as affected, and said seed phrases, private keys, and login details could be exposed.
What Binance said about the flaw
The exchange described this as an operating system issue rather than a problem tied to Binance alone. It said the normal boundary that keeps each app’s private files separate is at risk. If an attacker crosses that boundary, wallet data and other app data can become accessible.
Researcher forcequitOS published worse_query as a developer proof of concept. Its documentation describes a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2. A sandbox limits what an app can access, including files held by other apps, and the project lists access to application data folders, shared App Group folders, and some system locations. The researcher called it a proof of concept that “isn’t useful by itself,” not a complete theft tool.
What the research repository shows
The worse_query repository documents file access, not confirmed cryptocurrency theft. SlowMist security chief 23pds separately warned that untrusted IPA packages could use this access to expose wallet recovery phrases, keystores, or browser cache data stored without encryption. The flaw does not automatically drain wallets.
That distinction depends on what the wallet stores and how it protects those records. Access to a wallet’s files does not necessarily reveal usable private keys. Risk varies with the contents of the files and the protections applied to them.
Related iPhone security context
Cybersecurity News previously covered iOS sandbox escape fixes that addressed similar failures in app isolation. Those earlier patches do not establish that worse_query is fixed. Related SparkKitty malware coverage described a different exposure path, where attackers searched phone images for recovery phrases instead of breaking app isolation.
Binance recommends deleting apps from untrusted sources, including sideloaded or manually signed IPA files, and updating iOS and installed apps. Anyone who suspects a breach should move funds to a new wallet created on a clean device and reset active login sessions. Apple’s security release page lists iOS 27.2.1 and iOS 26.7.3 updates released November 9, but that listing alone does not confirm a worse_query fix, and an update should not be treated as proof that wallet secrets exposed earlier are safe.
Licensed under CC BY-ND 4.0 International