Binance warned iPhone users about an iOS vulnerability called worse_query that could let malicious apps read other apps' files. The exchange says it puts seed phrases, private keys and logins at risk. Apple released an update, but its security notes do not say whether it fixes the flaw.
Binance has warned iPhone users about an iOS vulnerability that it says could let malicious apps read files stored by other apps. The exchange says the flaw puts crypto wallet seed phrases, private keys and login credentials at risk.
Which iOS versions are affected
The flaw, dubbed "worse_query," affects iOS 26.7.1, 27.0.1 and 27.2, Binance said in a tweet on Tuesday. The exchange stressed that this is an iOS-level issue, not unique to Binance.
iPhone apps normally run inside a sandbox, which stops them from accessing other apps' private files. A researcher who goes by forcequitOS published worse_query on GitHub as a sandbox escape, describing it as a proof of concept for developers. There have been no confirmed reports of crypto being stolen using the flaw.
What Binance tells users to do
Binance urged users to delete apps installed from untrusted sources, such as sideloaded or manually signed app files, and to update iOS and all apps to the latest official versions. Anyone who suspects a breach should move their funds to a new wallet created on a clean device and reset all active login sessions, the exchange said.
Apple's update leaves a question open
Apple released iOS 27.2.1 on Monday, a day after the proof of concept was published. Its security notes list fixes for nine vulnerabilities, but they do not mention worse_query, and Apple has not publicly confirmed whether the update addresses the flaw.
Crypto Briefing reports that Apple also shipped iOS 26.7.3 on the same day, and that its notes likewise did not explicitly confirm a fix.
However, at least one security expert believes the update works. 23pds, chief information security officer at blockchain security firm SlowMist, urged users to update to iOS 27.2.1, saying in a tweet that it would block the worse_query sandbox escape.
Sources: Decrypt, Crypto Briefing
Trading involves risk.
Risk Disclaimer
