Overview
- A public proof‑of‑concept named worse_query was posted to GitHub and demonstrated by third‑party tools, showing an app can read and edit files stored by other apps.
- The exploit requires an App Group container to access other apps’ data, which makes sideloaded or manually signed apps the primary practical delivery method rather than typical App Store installs.
- Apple issued iOS updates on Monday that list several security fixes but do not name worse_query or confirm a targeted patch, and the researcher says the technique still works in some recent builds.
- Binance warned users on Tuesday to remove untrusted or sideloaded apps, update iOS and installed apps, and move funds to a new wallet on a clean device if they suspect compromise.
- The real risk depends on how a wallet stores secrets because wallets that keep keys in the Secure Enclave or never write plaintext recovery phrases to local files are far less exposed.