Overview
- Binance issued an alert on Tuesday saying a proof-of-concept called worse_query can let a malicious app read files belonging to other apps on iOS 26 and 27, putting seed phrases, private keys and login credentials at risk.
- The PoC was published by researcher forcequitOS on Nov. 8 and developers have already built sideloadable apps, such as WQ Files, that demonstrate browsing and editing other apps’ data without a jailbreak.
- Apple released iOS security updates on Nov. 9 (iOS 27.2.1 and 26.7.3) but its advisories do not name worse_query or confirm that the specific sandbox escape is fixed.
- Exploitation requires installing an app that creates an App Group container, so the threat is strongest for users who install untrusted or sideloaded IPAs; wallets that keep keys in hardware-backed stores or encrypted keychains face far lower risk.
- Binance and security firms recommend deleting untrusted apps, updating to official iOS releases, and creating a new wallet on a clean device to move funds if compromise is suspected, and no confirmed thefts tied to worse_query have been reported so far.