Binance has issued a security warning about a public iOS exploit called worse_query. The technique lets one app break out of its sandbox and read files that belong to other apps. If a malicious app uses it, seed phrases, private keys, and login credentials stored on an iPhone could end up exposed. Apple shipped new iOS updates a day before the warning, but its release notes do not say they fix the problem.
What Binance Warned About the iOS worse_query Flaw
Binance published its warning on November 10. The exchange says the problem sits inside iOS itself, so it affects every app on the phone and not only Binance.
The exchange gave users four steps:
- Delete apps that came from untrusted sources, including sideloaded apps and manually signed IPA files.
- Update iOS to the latest version.
- Update every installed app to its latest official release.
- If you suspect a breach, create a new wallet on a clean device, move your funds there, and sign out of all active login sessions.
Binance also stressed that deleting a suspicious app does not undo the damage if someone already copied your seed phrase or private key. A copied key stays valid until you move your funds to a new wallet.
Which iOS Versions Are Affected by worse_query?
Binance names iOS 26.7.1, 27.0.1, and 27.2 as affected. These match the versions tested in the WQ Files release notes.
The researcher gives a wider range. He lists iOS 26.0 through 26.7.2, plus iOS 27.2. Developers of another app built on the technique, Erosion, added iOS 27.2.1 to their README this week with a note that they were "pretty sure" it works. Treat that as an unconfirmed claim. Nobody lists iOS 26.7.3 as supported.
How the iOS Sandbox Escape Lets Apps Read Other Apps' Data
iOS isolates each app in its own sandbox, so one app cannot freely browse the private files of another. The worse_query technique crosses that wall. According to the researcher, the code can reach app data containers, extension data, internal daemon containers, and shared App Group storage. On iOS 27, it also reaches some extra system paths.
The exploit does not need a jailbreak or a kernel exploit. It does need one thing: the app using it must set up an App Group container.
The researcher goes by forcequitOS and published the code on GitHub with help from 0xjohnny. He calls worse_query the direct successor to an older technique named bad_query. He describes the code as a developer proof of concept and says it "isn't useful by itself." Other developers did not wait, though.
WQ Files: The Sideloaded App Built on worse_query
Developer Christoph Kolbicz built WQ Files on top of worse_query. It works as a file browser, app data manager, and cache cleaner for iOS 26 and 27. Users can browse the data of other apps, export it, back it up, restore it, edit it, delete it, and clear it.
WQ Files installs through sideloading tools like AltStore and SideStore. Those tools create the required App Group automatically when a user signs in with an Apple ID.
Nobody has said whether an app from the App Store could use worse_query. For now, the realistic risk comes from apps installed outside the App Store, the same route attackers use in fake software downloads.
Does iOS 27.2.1 or 26.7.3 Fix worse_query?
Apple has not confirmed a fix. The company released iOS 27.2.1, iOS 26.7.3, and iOS 18.7.12 on November 9. The updates patch nine flaws, including two iMessage bugs and several Bluetooth issues. The security notes for 27.2.1 and 26.7.3 do not mention worse_query or any sandbox escape.
Apple also says it does not discuss or confirm security issues until it finishes investigating and a patch is available. Install the updates anyway, since they close other real flaws.
Is the Apple CVE-2026-113963 Fix Related?
One flaw Apple fixed, CVE-2026-113963, could let an app access sensitive user data. Researcher László Várady reported it, and he found the access through App Intents, not App Group containers. That detail suggests it is a different bug from worse_query. No one has confirmed that either way.
Why the Researcher Released the Exploit Publicly
The researcher says he did not plan to publish worse_query this soon. He blames Apple for stalling on his report and says people started misusing the code in public. He also says he will not seek a bug bounty from Apple.
Has Anyone Lost Crypto to This iOS Exploit?
Neither Binance nor the researcher has reported any attack or theft linked to worse_query. Binance did not name any wallet app as exposed, and neither did the developers of the apps built on the exploit.
The real impact depends on what each app stores in files it can reach and whether that data has extra protection. The available documentation does not show that worse_query can decrypt every wallet or defeat every credential safeguard. It only shows that other apps' files become readable and editable.
How to Protect Your Crypto Wallet and Seed Phrase on iPhone
You can lower your risk today without waiting for Apple to respond. For a full checklist, read our guide on how to keep crypto safe.
- Install iOS 27.2.1 or 26.7.3 right away.
- Remove every sideloaded app, especially anything installed through AltStore, SideStore, or a manually signed IPA.
- Stay with the App Store for new installs, and skip apps from unknown developers.
- Update all your apps, including wallet and exchange apps.
- Avoid storing seed phrases in notes, screenshots, or plain files on your phone. Write them down offline instead.
- Consider a hardware wallet for larger holdings, since it keeps keys off the phone entirely. Buy only from official sellers, because the Ledger implant case shows what tampered devices can cost.
- Turn on two-factor authentication on your exchange accounts and review your active sessions. Our guide to wallet and exchange security covers phishing and malware defenses in more detail.
If you ever installed a sideloaded app that could have run this technique, assume your data may be exposed. Create a fresh wallet on a clean device and move your funds.
Frequently Asked Questions
What is worse_query?
It is a public iOS sandbox escape that lets an app read, edit, and delete the files of other apps. The researcher forcequitOS released it on GitHub.
Which iOS versions are affected?
Binance lists iOS 26.7.1, 27.0.1, and 27.2. The researcher's range is wider and covers iOS 26.0 through 26.7.2 plus iOS 27.2.
Does iOS 27.2.1 or 26.7.3 fix it?
Apple has not confirmed that. Neither update's security notes mention worse_query or a sandbox issue.
Can an App Store app use this exploit?
No one has said either way. The known tools install through sideloading.
Has anyone lost crypto because of it?
Neither Binance nor the researcher reports any theft or attack so far.
Does the exploit need a jailbreak?
No. It needs no jailbreak and no kernel exploit, but the app must create an App Group container.
What should I do if I suspect a breach?
Create a new wallet on a clean device, move your funds, and reset all active login sessions.
Related Guides
- Crypto Wallet Security: Hardware vs Software Wallets, Seed Phrases and Scam Protection
- How to Keep Crypto Safe: Complete Wallet and Exchange Security Guide
- Best Crypto Hardware Wallets in 2026: Top 5 Picks
- Ledger Wallets Sold by CryptoBilis Hid a Spy Implant, and Over $86 Million Has Vanished
- Fake Software Downloads Are Now Installing Cryptojacking Malware on Your PC
