Cryptocurrency exchange Binance has issued a critical warning to iPhone users regarding an iOS vulnerability that could expose highly sensitive personal data, including cryptocurrency wallet keys, seed phrases, and login credentials.
The flaw, identified as "worse_query," reportedly allows malicious applications to bypass Apple's stringent sandbox security measures, which are designed to isolate apps and prevent them from accessing each other's private data. This means information typically kept secure within one application could be read by another, potentially malicious, app.
Understanding the iOS Sandbox Flaw
The "worse_query" vulnerability affects iOS versions 26.7.1, 27.0.1, and 27.2. It is described as a sandbox escape, a serious type of flaw where an application can break out of its designated security boundaries. Normally, the iOS sandbox ensures that each app operates in its own isolated environment, preventing unauthorized access to data belonging to other applications.
The concern escalated after a security researcher, using the name forcequitOS, published a proof-of-concept on GitHub. This tool, named WQ Files, demonstrates how the vulnerability can be exploited to browse, export, edit, and even delete data from other applications without requiring a jailbroken iPhone.
Binance's Urgent Recommendations
In a post on X (formerly Twitter) on November 10, 2026, Binance urged iPhone users to take immediate action to protect their digital assets. The exchange's recommendations include:
- Delete Untrusted Apps: Remove any applications installed from unverified sources, such as sideloaded apps or manually signed IPA files.
- Update iOS and Apps: Ensure both the iOS operating system and all installed applications are updated to their latest official versions.
- Suspected Breach Protocol: If a breach is suspected, users should transfer all funds to a new cryptocurrency wallet created on a clean, secure device. Additionally, all active login sessions for affected services should be reset.
Apple's Response and User Uncertainty
While Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, 2026, the official security notes for these updates do not explicitly mention a fix for the "worse_query" vulnerability. This lack of clarity leaves users uncertain whether the latest updates fully address the critical flaw.
Binance has clarified that this is an iOS-level issue, not specific to its platform, affecting the entire ecosystem. Although no confirmed reports of cryptocurrency theft directly linked to this vulnerability have surfaced yet, the warning underscores the inherent risks associated with installing applications from unverified sources.
Users are strongly advised to remain vigilant and prioritize security best practices, especially when dealing with sensitive financial information on mobile devices.