Binance issued a stark warning on Tuesday that an iOS vulnerability named "worse_query" allows malicious applications to read files stored by other apps. This breach exposes crypto wallet seed phrases, private keys, and login credentials to theft. The exchange stated the flaw affects iOS 26.7.1, 27.0.1, and 27.2, urging users to delete sideloaded or manually signed app files immediately. It also advised updating all software to the latest official versions to secure their devices against this specific threat.
The Sandbox Escape Mechanism
A researcher known as forcequitOS published the exploit on GitHub, describing it as a proof of concept for developers that "isn’t useful by itself." The code acts as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, reaching the folder where apps store data. It is the direct successor to an earlier exploit called bad_query. While no confirmed reports exist of stolen crypto using this method, the risk remains high for unpatched devices. ForcequitOS noted that iPhone apps normally run inside a sandbox which stops them from accessing other apps’ private files. However, this new vulnerability bypasses those protections entirely. I view this as a critical gap in security because it targets the core isolation mechanism that protects user data. The fact that it was released as a public repository means any developer can potentially weaponize it against vulnerable users.
Apple’s Unconfirmed Fix
Apple released iOS 27.2.1 on Monday, one day after the proof of concept appeared online. The update notes list fixes for nine vulnerabilities, including an authorization issue in App Intents that may let an app access sensitive user data. Yet, the documentation does not mention worse_query or its creator. Apple has not publicly confirmed whether the update addresses the flaw Binance described. SlowMist chief information security officer 23pds believes the update blocks the escape, urging users to install it. Earlier this year, Google warned of iOS malware targeting crypto apps on unpatched devices. In August, the Dutch national cyber agency reported hackers exploiting a macOS Screen Sharing flaw to plant Monero miners. These incidents show a clear pattern of attackers targeting Apple ecosystems. Users should assume the risk persists until Apple provides explicit confirmation.
