BleepingComputer reports that Binance warned iPhone users that a flaw in iOS 26.7.1, 27.0.1 and 27.2 lets malicious apps read other apps’ private files. Binance calls the flaw “worse_query”.
For an iPhone owner, the risk isn’t limited to crypto. If a malicious app can read another app’s files, it could in theory read whatever that app keeps on the phone. Binance’s own example is crypto: seed phrases, private keys and login credentials.
This is an iOS-level issue, not unique to Binance.
Binance, in a post on X
A researcher who goes by forcequitOS published the flaw on GitHub as a sandbox escape. Developer Christoph Kolbicz used it to build WQ Files, which can browse, export, edit and delete other apps’ data without a jailbreak. BleepingComputer confirmed that WQ Files works on all three versions Binance named, including iOS 27.0.1, Apple’s first iOS 27 maintenance update. It has to be installed on the phone, but attackers could spread it as a sideloaded app outside the App Store.
Apple hasn’t said whether its latest update fixes worse_query. Apple released iOS 27.2.1 and 26.7.3 on 9 November. Its iOS 27.2.1 security notes don’t mention the flaw. They do list an App Intents fix for an issue that may let an app access sensitive user data. BleepingComputer says it’s unclear whether that’s the same bug. Apple fixed a flaw of this kind in April, in iOS 26.4.2, which let forensic tools read deleted notifications.
Decrypt reports that 23pds, chief information security officer at SlowMist, urged users to update to iOS 27.2.1, saying it would block the worse_query sandbox escape.
Binance’s advice comes down to three steps:
- Delete any apps installed from untrusted sources, including sideloaded or manually signed IPA files.
- Update iOS and all apps to the latest official versions.
- If a breach is suspected, move funds to a new wallet created on a clean device and reset all active login sessions.
No cryptocurrency losses have been confirmed so far. Reading a wallet’s files doesn’t automatically give an attacker usable keys, though. Cryptika notes that the risk depends on what a wallet saves and how it protects those records.
