In Brief
- Binance has issued a caution regarding a vulnerability identified as “worse_query” in Apple’s iOS, which may permit harmful applications to infiltrate files from other apps, thereby jeopardizing sensitive seed phrases, private keys, and login credentials.
- The exchange disclosed that this flaw impacts iOS versions 26.7.1, 27.0.1, and 27.2, recommending users purge sideloaded applications and upgrade their devices accordingly.
- On Monday, Apple released iOS 27.2.1; however, the accompanying security notes fail to reference worse_query or confirm any mitigation of the issue.
Binance has alerted iPhone users to a notable vulnerability within Apple’s iOS, which could allow nefarious applications to access files generated by other apps, thereby endangering essential assets such as crypto wallet seed phrases, private keys, and login information.
This vulnerability, known as “worse_query,” affects iOS versions 26.7.1, 27.0.1, and 27.2. The exchange conveyed this information via a tweet on Tuesday, asserting that “this is an iOS-level issue, not unique to Binance.”
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…
— Binance (@binance) November 10, 2026
In light of this revelation, Binance advised users to uninstall any applications acquired from untrustworthy origins, including those that are sideloaded or manually signed, and to update their iOS and all applications to the most recent official versions.
Additionally, individuals who suspect a breach are encouraged to transfer their funds to a new wallet established on an unsuspecting device and to reset all active login sessions.
Typically, iPhone applications operate within a sandbox, which prevents unauthorized access to the private files of other applications.
A researcher known as forcequitOS made worse_query available on GitHub as a demonstration of a sandbox escape functionality for iOS versions 26.0 through 26.7.2 and iOS 27.2, characterizing it as a proof of concept for developers that “isn’t useful by itself.”
The repository indicates that this exploit can reach folders where iOS applications store their data, denoting it as the “direct successor” to a prior exploit, bad_query. To date, there have been no verified instances of cryptocurrency theft attributed to this flaw.
Apple’s Update
Apple launched iOS 27.2.1 on Monday, merely one day post the public release of the proof of concept.
The accompanying security notes highlight solutions for nine vulnerabilities, including an authorization issue in App Intents that might enable an application to access sensitive user information, along with various flaws related to Bluetooth and iMessage.
Nevertheless, the security notes omit any reference to worse_query or its discoverer, and Apple has not officially stated whether the update successfully addresses the vulnerability highlighted by Binance.
At least one cybersecurity expert opines that it likely does. 23pds, Chief Information Security Officer at blockchain security firm SlowMist, urged users to upgrade to iOS 27.2.1, asserting on Twitter that this update is designed to thwart the worse_query sandbox escape, alongside other threats.
This incident is not the first occasion that Apple devices have been the target of malicious actors. Earlier in the year, Google raised alarms regarding iOS malware directed at crypto applications on unpatched devices, while in August, the Dutch national cybersecurity agency reported that hackers were exploiting a vulnerability in Apple’s macOS Screen Sharing feature to surreptitiously install Monero miners on Macs.
Source link: Decrypt.co.
