Binance is warning about a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials.

The crypto exchange clarifies that the issue is at the iOS level and does not impact only the Binance app.

“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” Binance says.

At this time, no cryptocurrency losses have been confirmed, but Binance urges users to install the update immediately as a precaution.

The company recommends that users delete any unnecessary and untrusted apps and apply the latest versions for iOS and other apps.

Where compromise is suspected, Binance advises users to transfer funds to a new wallet created on a clean device and reset all active login sessions.

Public exploit available

“worse_query” is a publicly disclosed iOS sandbox escape technique that allows an application to cross security boundaries and access the storage of other applications.

Yesterday, a proof-of-concept exploit has been published that uses a tool called WQ Files to perform attacks relying on the technique. Specifically, WQ Files uses “worse_query” to browse, export, edit, and delete other apps’ data without requiring a jailbreak.

An attacker could

The tool must be installed on an iPhone for the attack to work, but an attacker could distribute it through untrusted sources as a sideloaded app, bypassing Apple's App Store.

WQ Files has been confirmed to work on iOS 26.7.1, 27.0.1, and 27.2, the same versions that Binance warned about.

Apple on November 9 released iOS security updates (iOS 27.2.1, 26.7.3, and 18.7.12) that address nine flaws. One of the fixed vulnerabilities, tracked as CVE-2026-113963, could allow an app to access sensitive user data.

It is unclear if this is the same security issue Binance is warning of, though.

The CVE-2026-113963 problem was reported by László Várady flaw, who found that the access occurred through App Intents, not App Group containers.

BleepingComputer has contacted Apple for clarifications and a request for comment, and we will add an update once we receive more details.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.