Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed
Binance has warned of an iOS sandbox escape vulnerability that could expose crypto wallet keys, with no fix confirmed in Apple's latest updates.
The vulnerability, named worse_query, was published on GitHub by a researcher who goes by forcequit on Sunday, just before Apple released updates for iOS 26 and 27. The escape allows an app to read other apps' files on iPhones running these operating systems, potentially exposing seed phrases, private keys, and login credentials to malicious applications.
Apple's updates released yesterday do not list a fix for the sandbox escape. Neither Binance nor the researcher have reported any actual attacks or thefts involving this vulnerability at this time.
User Protection Measures
Binance has advised users to delete apps installed from untrusted sources, including sideloaded or manually signed applications. The exchange also recommended updating iOS and all apps to the latest versions. For users who suspect a breach, Binance recommends moving funds to a new wallet created on a clean device and resetting all active login sessions.
Apple does not disclose, discuss, or confirm security issues until it has investigated and a patch or release is available.
Vulnerability Details
The proof-of-concept code can reach every app's data container on an iPhone and some system folders on iOS 27. To exploit it, an app must set up an App Group container. Developer Christoph Kolbicz has created WQ Files, a file manager built on worse_query, which can read, edit, delete, and clear other apps' data without requiring a jailbreak.
WQ Files installs via sideloading tools like AltStore and SideStore, which automatically create the necessary App Group when used with an Apple ID. The researcher claims the code is intended for developers and "isn't useful by itself," though others have built functional applications on it.
Related
