Binance has warned Apple users about an iOS vulnerability called 'worse_query' that could expose cryptocurrency wallets, private keys, and login credentials. The security flaw allows malicious applications to bypass Apple's application sandbox and access files normally isolated inside other apps. The vulnerability affects multiple iOS versions and threatens not only crypto wallets but any apps storing sensitive information locally, including passwords and authentication data. Binance attributes the problem to iOS itself rather than its own wallet infrastructure and urges users to remove untrusted applications immediately. The warning adds to growing concerns about smartphone security for cryptocurrency holders following several recent incidents involving malicious iOS applications.
Worse_Query Exploits Apple Application Sandbox
The 'worse_query' vulnerability exploits Apple's application sandbox, a security mechanism designed to keep applications separated from one another. Normally, an application cannot freely access another application's private files, protecting sensitive information even when users install multiple applications on the same device. The exploit reportedly bypasses those restrictions, allowing a malicious application to potentially access directories containing information belonging to other installed applications. The researcher behind the public GitHub repository describes 'worse_query' as a sandbox escape. Binance warns that exposed information could include cryptocurrency recovery phrases, private keys, and login credentials. The actual danger depends partly on how individual applications store sensitive information, with wallets retaining recovery phrases or other credentials in accessible local files facing particular risks.
Affected iOS Versions Span iOS 26 and iOS 27 Releases
The vulnerability affects iOS 26 and iOS 27, with the GitHub project identifying affected releases spanning iOS 26.0 through 26.7.2 and iOS 27.2. Apple released iOS 27.2 and iOS 26.7.2 on October 26, 2026, according to Apple's security releases list. However, Apple's published security advisories do not explicitly identify 'worse_query' by name. There is currently no confirmed public statement establishing that these updates fully resolve the specific sandbox escape. A separate GitHub project implementing the exploit reported on November 8 that Apple's available software releases had not patched 'worse_query'. This leaves users with a gap between installing the latest available update and confirming that a particular vulnerability has been fixed.
Binance Recommends Creating New Wallets on Clean Devices
Binance recommends installing the latest official iOS release and keeping all applications updated. The exchange urges users to remove applications from unknown sources, including manually signed IPA files. Users who suspect their devices have been compromised should create new wallets on clean devices and move their funds. Binance also recommends resetting active login sessions and updating installed software. SlowMist's security chief warned that the vulnerability could undermine assumptions about isolation between application containers. Security researchers have highlighted the importance of protecting plaintext wallet information.
Previous iOS Security Incidents Targeted Crypto Applications
In September, Binance warned users about FomoPeek, a third-party application whose versions 1.1 and 1.2 reportedly contained malicious code. Security researchers found that the software could exploit iOS vulnerabilities to obtain elevated device privileges. Potentially exposed information included recovery phrases, private keys, login credentials, and other locally stored data. More recently, CertiK highlighted the DarkSword exploit framework, which reportedly targeted cryptocurrency applications through compromised websites and vulnerable iPhones. These incidents involve separate attack methods but demonstrate why smartphone security has become increasingly important for crypto holders.
FAQ
What is the 'worse_query' iOS vulnerability that Binance warned about?
The 'worse_query' vulnerability is a sandbox escape affecting iOS 26 and iOS 27 that allows malicious applications to bypass Apple's application isolation and access files belonging to other installed applications. According to Binance's warning, the flaw could expose cryptocurrency recovery phrases, private keys, login credentials, and other sensitive information stored locally by apps. The vulnerability exploits Apple's application sandbox security mechanism, which normally prevents applications from accessing each other's private files.
Which iOS versions are affected by the 'worse_query' vulnerability?
The vulnerability affects iOS versions spanning iOS 26.0 through 26.7.2 and iOS 27.2, according to the GitHub repository describing the exploit. Apple released iOS 27.2 and iOS 26.7.2 on October 26, 2026, but Apple's published security advisories do not explicitly identify 'worse_query' by name. A GitHub project reported on November 8 that Apple's available software releases had not patched the vulnerability, leaving no confirmed public statement that these updates fully resolve the specific sandbox escape.
What should iPhone users do if they suspect their device is compromised by this vulnerability?
Binance recommends that users who suspect compromise should create new wallets on clean devices and move their funds. The exchange also advises resetting active login sessions, updating installed software, and installing the latest official iOS release. Users should remove applications from unknown sources, including manually signed IPA files. Binance urges immediate removal of untrusted applications to protect cryptocurrency wallets and other sensitive information stored on affected devices.
