Hardware Ready Ready to Bench?
The exchange Binance has issued a new security warning regarding a vulnerability present in the iOS operating system, named “worse_query”. This flaw could allow malicious applications to access files from other apps installed on users’ iPhones.
According to a statement from Binance, the vulnerability specifically affects iOS versions 26.7.1, 27.0.1, and 27.2. A carefully crafted application could exploit “worse_query” to access sensitive data stored by other apps, including seed phrases, private keys, and digital wallet login credentials.
iOS worse_query: why it matters
Binance clarified that this is an operating system-level issue and not specific to its own application. This means the entire range of crypto applications installed on iPhones could potentially be exposed to risk, highlighting the scope of the problem within the iOS ecosystem.
At present, Binance reports having received no reports of fund thefts directly linked to this vulnerability. However, “worse_query” represents a “sandbox escape” technique, meaning a method for bypassing the security measures that normally isolate applications on iOS, allowing them to access data from other apps without user authorization.
The researcher signing as forcequit published proof-of-concept code on GitHub, demonstrating the possibility of exploiting “worse_query” to elude iOS sandbox protections. Subsequently, another developer used this code to create “WQ Files,” a file manager that allows users to view, export, modify, and delete data from other applications without needing to jailbreak the device.
“WQ Files” can be installed via sideloading using alternative stores such as AltStore or SideStore, bypassing the official App Store. The application’s release notes indicate compatibility with iOS versions 26.7.1, 27.0.1, and 27.2, the same ones highlighted by Binance in its warning published on the X platform.
What changes and what are the effects
On November 9, Apple released iOS updates 27.2.1 and 26.7.3, resolving nine security vulnerabilities. However, the release notes contain no explicit reference to fixing the “worse_query” flaw. Among the corrected vulnerabilities is CVE-2026-113963, which allowed an app to access sensitive user data via App Intents but not through App Group containers. It is not yet clear whether this fix is related to the vulnerability reported by Binance or if it is a distinct issue.
Pending official clarifications from Apple, Binance recommends that users uninstall any applications from untrusted sources and immediately update iOS and all installed apps to their latest versions. In case of suspected security compromise, the exchange advises transferring funds to a new wallet created on a clean device and resetting all active login sessions, also changing the associated passwords.
At present, it is not possible to confirm with certainty whether the updates released by Apple have actually resolved the “worse_query” vulnerability or if the problem remains exploitable on the latest versions of iOS. Further clarifications from Cupertino will be needed to fully understand the extent of the risk and the necessary corrective measures.
Source and further reading on iOS worse_query: original article.
* Content created with the assistance of artificial intelligence systems.