Binance has warned iPhone users about a publicly available iOS sandbox escape that could let a malicious app access files stored by other apps, potentially exposing cryptocurrency recovery phrases, private keys and login credentials. The exchange identified the issue as worse_query and said it affects iOS itself rather than Binance software. Its November 10 security warning lists iOS 26.7.1, 27.0.1 and 27.2 among the affected versions.
The technique was published on GitHub by a researcher using the name forcequit, working with 0xjohnny. The project describes worse_query as a developer-focused proof of concept for iOS 26 and 27. Its README lists support for iOS 26.0 through 26.7.2 and iOS 27.2, and says an app needs an App Group container to use it. The code can reach data containers belonging to other apps and certain system directories, but the repository says it is not a jailbreak and is not useful on its own.
A separate project, WQ Files, has turned the technique into a file manager that can browse and modify other apps’ data without a jailbreak or kernel exploit. Its developer says it was built and tested on iOS 27.0.1. The available research does not establish whether an ordinary App Store app could use the same method.
Binance said it had no confirmed cases of attackers using the flaw to access cryptocurrency wallets or steal funds. Neither the exchange nor the researcher identified a specific wallet app as compromised. The risk depends on what sensitive information an app stores in files that could be reached by a malicious app.
Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, fixing several Bluetooth, AirPlay and Messages vulnerabilities. The company’s iOS 27.2.1 security notes and iOS 26.7.3 security notes do not mention worse_query or describe a sandbox fix. That omission does not establish whether the latest software is vulnerable, and public version testing remains incomplete for those newer releases. Apple says it does not discuss or confirm security issues until an investigation has taken place and patches or releases are generally available.
The issue follows other reports of iPhone attacks targeting cryptocurrency information, including the DarkSword exploit campaign targeting crypto wallets and personal data. The two cases involve different techniques and should not be treated as the same vulnerability.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
