Binance warns of iOS 'worse_query' sandbox escape that lets malicious apps read other apps' files, including wallet seed phrases; public proof-of-concept tool WQ Files works on iOS 26.7.1, 27.0.1 and 27.2 (10 Nov)
Crypto exchange Binance is warning about a vulnerability in Apple's iOS 26.7.1, 27.0.1 and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys and login credentials, BleepingComputer reported on 10 November 2026.
Binance says the issue is at the iOS level and does not affect only the Binance app. According to BleepingComputer, 'worse_query' is a publicly disclosed iOS sandbox escape technique that lets an app cross security boundaries and access other apps' storage. A proof-of-concept tool called WQ Files uses it to browse, export, edit and delete other apps' data without a jailbreak, and has been confirmed to work on iOS 26.7.1, 27.0.1 and 27.2.
The tool must be installed on the iPhone, but an attacker could distribute it as a sideloaded app outside the App Store.
No cryptocurrency losses have been confirmed. Apple released iOS 27.2.1, 26.7.3 and 18.7.12 on 9 November with fixes for nine flaws, including CVE-2026-113963 (an app may be able to access sensitive user data, via App Intents); BleepingComputer says it is unclear whether that is the issue Binance warned about and has asked Apple to comment.
Apple has not said publicly that worse_query is fixed. (source: BleepingComputer)
- Product
- Apple iOS (iPhone); apps that store secrets in local files, including crypto wallets
- Versions
- Named by Binance and confirmed for WQ Files: iOS 26.7.1, 27.0.1, 27.2. No Apple fix confirmed for worse_query as of 11 Nov.
- Exploited in Australia?
- unknown
- Patch to
- Update iOS to the latest release (27.2.1, 26.7.3 or 18.7.12) and update all apps, noting Apple has not confirmed it fixes worse_query. Per Binance: delete unnecessary and untrusted apps, especially sideloaded ones; if compromise is suspected, move funds to a new wallet created on a clean device and reset all active login sessions.