Binance has warned iPhone users that a flaw in Apple's iOS could let a malicious app read private files stored by other apps, including cryptocurrency seed phrases, secret keys and login credentials. The exchange said the problem, known as worse_query, affects iOS 26.7.1, 27.0.1 and 27.2, and stressed that it is an iOS-level issue rather than a weakness in the Binance app alone.

No cryptocurrency losses have been confirmed, Binance said, but it urged users to install the latest iOS update immediately as a precaution. It also advised users to delete unnecessary and untrusted apps, keep iOS and their apps up to date, and, where compromise is suspected, move funds to a new wallet created on a clean device and reset all active login sessions.

What worse_query does

Worse_query is a publicly disclosed iOS sandbox escape technique. It allows an application to cross the security boundaries that are supposed to keep each app's data separate and reach the storage of other applications. A proof-of-concept exploit using a tool called WQ Files was published on 9 November. According to the report, the tool can browse, export, edit and delete other apps' data without requiring a jailbreak.

The tool must first be installed on the iPhone, but an attacker could distribute it through untrusted sources as a sideloaded app, bypassing Apple's App Store. WQ Files has been confirmed to work on iOS 26.7.1, 27.0.1 and 27.2, the same versions named in Binance's warning.

Apple's update and an open question

Apple released iOS security updates on 9 November, including iOS 27.2.1, 26.7.3 and 18.7.12, addressing nine flaws. One of the fixed vulnerabilities, tracked as CVE-2026-113963, could allow an app to access sensitive user data. It is not clear whether that is the same issue Binance is warning about: the CVE-2026-113963 flaw was reported by researcher László Várady and involved access through App Intents rather than App Group containers, while Binance's warning describes a sandbox escape.

BleepingComputer has contacted Apple for clarification. Until the link is confirmed, the practical advice is the same either way: install the latest iOS update, remove apps you do not trust, and treat any app installed from outside the App Store with suspicion. Full details are in the BleepingComputer report and the TechRepublic report on iOS 27.2.1.