Binance has issued a warning about a newly disclosed iOS sandbox escape vulnerability that could allow malicious apps to access sensitive data, including crypto wallet keys, on iPhones running iOS 26 and 27. The flaw, named worse_query, was published on GitHub by a researcher known as forcequit. Despite Apple's recent iOS updates, no patch for this vulnerability has been confirmed.
The vulnerability enables apps to read files from other installed applications, potentially exposing seed phrases, private keys, and login credentials. Binance advised users to remove apps from untrusted sources, update their iOS and apps, and take precautionary measures if they suspect a breach, such as moving funds to a new wallet on a clean device.
A proof-of-concept code for worse_query has been developed into an app called WQ Files, which can access and modify data from other apps without requiring a jailbreak or kernel exploit. This app is distributed through sideloading tools like AltStore and SideStore. Neither Apple nor the researchers have confirmed whether apps from the App Store could exploit this vulnerability.
Apple's latest updates, iOS 27.2.1 and iOS 26.7.3, did not address the sandbox escape issue, focusing instead on fixing iMessage flaws and Bluetooth bugs. The researcher behind worse_query mentioned that Apple had been slow to respond, prompting the early release of the exploit.