If you keep a crypto wallet on your iPhone, Binance wants you to check what else is installed on it. The exchange warned on November 10 that an iOS flaw called worse_query “allows malicious apps to read local files” belonging to other apps, and the researcher who found it has already put working proof-of-concept code on GitHub.
The awkward part for Apple is timing. The code went public on November 8. Apple shipped iOS 27.2.1 a day later, and its security notes for that update list nine fixes, none of them for the app sandbox or the container system this bug abuses.
Binance says worse_query is an iOS problem that reaches beyond its own app
Binance named iOS 26.7.1, 27.0.1 and 27.2 as affected, according to its advisory as quoted by CyberInsider. It said exposed files could include wallet seed phrases, private keys and login credentials. And it was blunt about scope: “This is an iOS-level issue, not unique to Binance.”
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
That last line is the one to take seriously. A seed phrase is the master key to a wallet. If an app copies it once, deleting that app later doesn’t help, because whoever has the phrase can rebuild the wallet anywhere.
Neither Binance nor the researcher has reported a single attack or theft tied to the flaw so far. This is a warning about what’s possible, not a report of stolen money.
How the worse_query sandbox escape works, according to Ostorlab’s breakdown
Every iPhone app lives in its own sandbox, a walled-off space it can’t see out of. Security firm Ostorlab published a technical breakdown on November 10 that explains how worse_query gets around that.
The trick uses App Groups, the shared folders Apple lets a developer’s apps and extensions use to swap data. A malicious app replaces its own App Group cache folder with a shortcut, called a symlink, that points somewhere else on the phone. The iOS service that hands out folder access follows that shortcut and grants access to the target without checking that it still sits inside the app’s own space. From there the app can read other apps’ data containers.
Ostorlab says no jailbreak and no kernel exploit is needed. The researcher’s README is just as direct, saying the project “is not relevant to a jailbreak and never will be.” It lists iOS 26.0 through 26.7.2 and iOS 27.2 as working, a wider range than Binance named.
Someone has already turned it into a tool. Developer Christoph Kolbicz released WQ Files, a file browser that uses the same technique to open, back up, edit and delete other apps’ data. Its README says it was tested on iOS 26.7.1, 27.0.1 and 27.2, and it installs only by sideloading through tools like AltStore and SideStore.
Apple’s iOS 27.2.1 security notes fix nine bugs but none in the sandbox
Here’s what Apple did patch on November 9. The iOS 27.2.1 notes cover AirPlay, Bluetooth, two CoreUtils pairing bugs, two iMessage group chat flaws, rapportd, the brotli compression library and App Intents. The update runs on iPhone 11 and later.
The App Intents entry, CVE-2026-113963, says an app “may be able to access sensitive user data.” Bitdefender pointed to it, but Apple doesn’t connect it to worse_query, and nobody has shown that it closes the hole. Ostorlab says Apple has published no advisory, no CVE and no patched version for this specific escape, and that it wasn’t on the US government’s list of known exploited bugs as of November 10.
So you should still install iOS 27.2.1, because the Bluetooth and iMessage fixes are real. Just don’t treat it as protection against this one.
What iPhone owners with crypto wallets should do before Apple ships a fix
The good news is that the attack needs a bad app on your phone first. Ostorlab says it requires a sideloaded or attacker-controlled app with an App Group container, running locally on the device. It can’t reach in over the internet by itself. Data protection may also keep some files unreadable while the phone is locked, though Ostorlab didn’t measure how much.
Binance, Ostorlab and Bitdefender line up on the same steps:
- Delete any app you didn’t get from the App Store, including sideloaded or self-signed IPA files and apps from AltStore-style sources.
- Remove configuration profiles you don’t recognize in Settings, under General, then VPN and Device Management.
- Install iOS 27.2.1 for the other fixes, and update your wallet apps.
- Stop keeping recovery phrases in screenshots, Photos or Notes, where any app that can read files can find them.
- If you ran an untrusted app, make a new wallet on a clean device, move your funds and sign out of active sessions.
If you hold a large balance, Bitdefender also suggests a hardware wallet, which keeps the keys off your phone entirely. And if a message arrives asking you to type in your seed phrase to “secure” your wallet after this news, it’s a scam. No real exchange asks for it.
Apple’s last update round fixed a long list of Bluetooth and iMessage bugs, which we covered in our iOS 27.2.1 report. If you were one of the people who got Apple’s recent threat notification, read what Apple told users in 99 countries, because that’s a separate problem with separate advice.
Discussion