WQ Files

Binance Warns of Unpatched iOS Sandbox Escape worse_query Exposing Crypto Wallet Keys on iOS 26 and 27

Binance has issued a security advisory about an iOS sandbox escape vulnerability called worse_query that enables malicious apps to read files from other applications, including crypto wallets containing seed phrases, private keys, and credentials. The proof-of-concept exploit, published by researcher forcequit on GitHub, works on iPhones running iOS 26 and iOS 27 without requiring a jailbreak or kernel exploit. Apple's recent updates for iOS 26.7.3 and iOS 27.2.1, released yesterday, do not address the issue according to the official security notes. Apps built on the exploit, such as the WQ Files file manager by developer Christoph Kolbicz, can be installed via sideloading tools like AltStore and SideStore that automatically configure the required App Group container. Binance advises users to remove any sideloaded or untrusted apps, update all software, and move funds to a new wallet on a clean device if a breach is suspected. Neither Apple nor the researcher has confirmed any in-the-wild attacks or thefts involving the vulnerability.