Binance warned iPhone users Tuesday that a publicly disclosed iOS vulnerability could allow malicious apps to read files from other apps, potentially exposing seed phrases and private keys stored on the device. The flaw affects iOS 26.7.1, 27.0.1, and 27.2, according to the exchange's statement on X.
Researcher forcequitOS released the exploit, called worse_query, on GitHub on Nov. 8, describing it as a sandbox escape for iOS 26 and 27. The bug allows malicious code to break out of app containers that iOS normally keeps isolated. The proof of concept works on iOS versions 26.0 through 26.7.2 and 27.2. Developer Christoph Kolbicz built the exploit into a file manager app one day after release, allowing users to browse and edit app data on iOS 27 without jailbreaking.
SlowMist, a blockchain security firm, noted that the flaw will not steal assets on its own. The attack requires a user to first install an untrusted app outside the App Store, which then reads other apps' containers. Wallets storing recovery phrases or keys in plain text on the device face the most risk. Hardware wallets and software wallets that encrypt sensitive data locally remain largely unaffected.
Apple released iOS 27.2.1 and iOS 26.7.3 on Nov. 9, a day after the exploit went public. The security notes mention fixes for AirPlay, Bluetooth, and brotli but do not name worse_query or describe a sandbox escape fix. It remains unclear whether the latest iOS builds block the technique.
Binance told users to delete apps from untrusted sources, update iOS and apps to official latest versions, and move funds to a new wallet on a clean device if they suspect a breach. The exchange and the researcher have not reported any thefts tied to the vulnerability. Neither Binance nor apple officials have confirmed whether the latest patches address the flaw.