Binance has issued a public warning about a serious vulnerability in Apple’s iOS that could allow third-party applications to access sensitive data stored by other apps, including cryptocurrency seed phrases, private keys, and login credentials.
The issue affects iOS 26.7.1, 27.0.1, and 27.2. According to Binance, the flaw exists at the operating-system level and is not limited to the Binance application itself. The vulnerability, tracked internally as worse_query, is a publicly disclosed iOS sandbox escape technique that permits an app to cross security boundaries and read files belonging to other applications.
Yesterday a proof-of-concept exploit was published that uses a tool called WQ Files to perform these attacks. The tool can browse, export, edit, and delete data from other apps without requiring a jailbreak. While the malicious application must be installed on the target device, it can be distributed through untrusted sources via sideloading, bypassing the Apple App Store.
Binance states that no cryptocurrency losses have been confirmed at this time. Nevertheless, the exchange urges users to install the latest iOS updates immediately, delete any unnecessary or untrusted applications, and, in cases where compromise is suspected, transfer funds to a new wallet created on a clean device while resetting all active login sessions.
On November 9, Apple released security updates for iOS 27.2.1, 26.7.3, and 18.7.12 that address nine vulnerabilities. One of the fixed issues, CVE-2026-113963, was reported by researcher László Várady and allows an app to access sensitive user data through App Intents. It is still unclear whether this CVE corresponds exactly to the worse_query flaw described by Binance.
