worse_query: the iOS sandbox escape Binance warned iPhone users about

On Nov 10, Binance warned iPhone users about an iOS flaw called worse_query. Binance says it's an iOS-level problem that affects every app on the phone, and it isn't specific to Binance.

What it is: a sandbox escape. A malicious app can read files that belong to other apps, including app data containers, extension data, daemon containers and shared App Group storage. It reportedly doesn't need a jailbreak. For crypto users the worry is exposed seed phrases, private keys and saved logins. CyberInsider describes it as the successor to an earlier technique called bad_query.

Affected versions: Binance named iOS 26.7.1, 27.0.1 and 27.2. The researcher's public proof of concept lists a wider range, iOS 26.0 through 26.7.2 plus 27.2.

Binance's advice:

Delete apps from untrusted sources, such as sideloaded or manually signed IPAs
Update iOS and all apps
If you suspect a breach, move funds to a new wallet created on a clean device and reset active login sessions

Patch status is unclear. Apple released iOS 27.2.1 and iOS 26.7.3, but the security notes don't mention worse_query. SlowMist's CISO says the update should block it, and that's his view, not Apple's confirmation. Forbes also reports researchers saying it isn't fixed and could be exploited from an App Store app. CyberInsider says it's unclear whether App Store apps could do it. Treat that part as unresolved.

No confirmed thefts have been tied to this flaw so far. It's also a separate story from Binance's $6.3 billion hack, which some outlets mention in the same headlines.

Sources:

Decrypt: https://decrypt.co/382928/binance-warns-of-apple-ios-flaw-that-could-expose-iphone-users-private-keys
CyberInsider: https://cyberinsider.com/binance-ios-worse-query-sandbox-escape-crypto-wallet-secrets/
Forbes: https://www.forbes.com/sites/digital-assets/2026/11/13/immediate-action-required-urgent-warning-to-delete-iphone-apps-issued-after-biggest-ever-hack-sparked-massive-meltdown/
UNILAD: https://www.unilad.com/technology/iphone-hack-delete-apps-217499-20261112