Binance warns iPhone users of iOS flaw worse_query

Binance warned iPhone users on November 10 about a public iOS sandbox escape called worse_query that lets malicious apps read local files from other apps on affected iPhones by breaking app isolation.

Apple released iOS 27.2.1 and iOS 26.7.3 on November 9, but its security notes for those updates do not mention worse_query. Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected versions, while researcher documentation lists iOS 26.0 to 26.7.2 and iOS 27 to 27.2. Whether iOS 27.2.1 and iOS 26.7.3 fix the flaw remains unclear. Apple’s policy is not to disclose, discuss or confirm security issues until its investigation is complete and a patch or release is available.

The proof of concept became public on November 8 when forcequitOS published worse_query code on GitHub, one day before Apple shipped its November 9 updates. forcequitOS says the code is aimed at developers and is not useful on its own. forcequitOS will not ask Apple for a bug bounty and is giving up any possible reward.

Apple was stalling on responding to me and people started larping with it on here.

forcequitOS, The Hacker News

To use worse_query, an app must set up an App Group container, a shared storage entitlement. The proof of concept reaches every app’s data container and some system folders on iOS 27. Worse_query is not a jailbreak. Developer Christoph Kolbicz built a file manager called WQ Files on top of the exploit, and other developers have built installable apps using it.

AltStore and SideStore can install WQ Files, and when a user signs in with an Apple ID, these sideloading tools create the needed App Group automatically. WQ Files can read, edit, delete and clear data belonging to other apps without a jailbreak or a kernel exploit. The GitHub project worse_query catalogs reachable app, extension and shared-container folders for iOS 26 and iOS 27.

Older devices running iOS 18 do not appear on any affected-version list, and users can check their version under Settings, General, About. Whether apps from the regular App Store can exploit the flaw remains unknown. Erosion’s developers list iOS 27.2.1 as supported, and no source lists iOS 26.7.3.

The flaw puts private keys, login credentials and seed phrases at risk. Anyone who knows it can restore wallet balances on any device and drain them. No source has confirmed or denied that worse_query can access the iPhone keychain. Beyond crypto wallets, any app that keeps sensitive data on the device is at risk.

Binance instructed users to remove apps obtained from untrusted sources, covering sideloaded and manually signed IPA files. The exchange said users should keep iOS and every application current through official channels. For suspected breaches, Binance says users should transfer assets to a fresh wallet on a clean device and end all active login sessions.

No attacks or data theft have been reported by Binance or the researcher in connection with worse_query.

Hardware wallets generate and store private keys on their own chip and never release them, so the phone only sends transactions for signing. With a hardware wallet, private keys stay on the device rather than on the phone. Encrypted storage and separately protected keys do not equal readable recovery phrases, and programs that never save recovery phrases or keys as plain files face different risk.

Apple’s security notes for iOS 27.2.1 and iOS 26.7.3 describe patches for AirPlay, Bluetooth pairing, brotli and additional parts. The iOS 27.2.1 notes describe fixes for nine vulnerabilities, among them an App Intents authorization flaw that lets an app reach sensitive user data. There is not yet a CVE entry for worse_query according to reports so far, and no confirmed public CVE number links the App Intents patch to this sandbox escape.

SlowMist’s chief information security officer, known as 23pds, said updating to iOS 27.2.1 would block the worse_query sandbox escape. Another GitHub project said on November 8, 2026, that Apple’s current software releases had not fixed worse_query.

worse_query is the direct successor to bad_query and essentially replaces it.

forcequitOS, Security Affairs

Worse_query is the direct successor to an earlier exploit from the same researcher called bad_query, which covered iOS 26.0 to 26.6.1 and the iOS 27.0 beta 4 build. The researcher collaborated with 0xjohnny on the release and had not planned to release worse_query early.

This is an iOS-level issue, not unique to Binance.

Binance, Bitcoin Magazine

The exchange’s iOS app and other apps on at-risk phones could be affected. No wallet app was identified as exposed by Binance, the researcher or the developers of apps based on worse_query.

Binance lost $6.34 billion in an October 29 attack that began with a fake job interview. Security researchers described exploit kits named Coruna and DarkSword in March 2026; they harvested wallet data, passwords and messages on older iOS versions. Binance warned in September about FomoPeek versions 1.1 and 1.2, which reportedly contained malicious code.

CertiK drew attention to the DarkSword exploit framework. Google issued a warning earlier this year about iOS malware aimed at crypto applications running on devices without patches. The Dutch national cyber agency said in August that hackers exploited an Apple macOS Screen Sharing flaw to install miners on Macs.