EN PT-BR
← Voltar ao feed
high cryptocurrency

Binance warns of unpatched worse_query iOS sandbox escape that exposes crypto wallet secrets

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 12:59 · coletado há 2 horas

Binance warned on November 10, 2026 that worse_query, a publicly disclosed iOS sandbox escape, could let a malicious app read other apps' local files, exposing seed phrases, private keys and login credentials. The technique was published as a proof of concept on GitHub by the researcher forcequitOS (github.com/kolbicz/WQFiles), and developer Christoph Kolbicz built the WQ Files file manager on it to browse, edit and delete other apps' data without a jailbreak. Binance names iOS 26.7.1, 27.0.1 and 27.2, while the proof of concept's own list runs from iOS 26.0 to 26.7.2 plus 27.2. No cryptocurrency losses have been confirmed. The attack requires a malicious app already on the device, typically a sideloaded one, but no fix is confirmed: Apple's iOS 27.2.1 and 26.7.3 security notes do not mention worse_query.

Entenda a falha

A vulnerabilidade

worse_query is an iOS sandbox escape with no CVE assigned. A malicious app already installed on the device, typically sideloaded, can read other apps' local files, including data containers, app group containers, extension data and some system locations. That exposes seed phrases, private keys and login credentials. Binance names iOS 26.7.1, 27.0.1 and 27.2, while the researcher's proof of concept lists iOS 26.0 to 26.7.2 plus 27.2. No fix is confirmed: Apple's iOS 27.2.1 and 26.7.3 notes do not mention it.

Como funciona

The attack runs locally, inside the sandbox of an app the victim has installed, not as a network service. According to Ostorlab, the app abuses the container manager's sandbox-extension API to cross the boundary that normally isolates each app's storage. Once across, it can browse, export, edit and delete other apps' data. The articles do not describe the internal steps in more detail.

Por que é vulnerável

The articles do not state a precise root cause. They only say the technique abuses the container manager's sandbox-extension API, so the sandbox boundary between apps can be crossed without a jailbreak or kernel exploit. Because no fix is confirmed, there is no description of what a patch would change.

Onde está

The flaw is in the iOS container manager's sandbox-extension API, per Ostorlab's analysis. The public proof of concept is at github.com/kolbicz/WQFiles; no fixing commit or specific file or function is named.

Como foi descoberta

The researcher forcequitOS published the technique and a proof of concept on GitHub; the repository was created on November 8, 2026. The articles do not say how the flaw was found or whether Apple was notified beforehand. Binance issued its warning on November 10, and no cryptocurrency losses are confirmed. Sources disagree on the fix: SlowMist's security chief says iOS 27.2.1 blocks it, while the researcher says it is not patched in iOS 27.2.1 or 27.3 beta 1. Apple has confirmed neither claim. Apple's separate App Intents fix, CVE-2026-113963, is not confirmed to be the same issue.

PoC pública

A public proof of concept exists on GitHub from forcequitOS. Developer Christoph Kolbicz built the WQ Files file manager on it; the app browses, exports, edits and deletes other apps' data without a jailbreak or kernel exploit, and was built and tested on iOS 27.0.1. It is a working tool, installable through sideloading tools such as AltStore and SideStore. Since it is public and no fix is confirmed, treat the risk as urgent: remove untrusted and sideloaded apps and keep iOS updated.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:23.

Detalhes técnicos

  • worse_query is a sandbox escape that reaches other apps' data containers, app group containers, extension data and some system locations (github.com/kolbicz/WQFiles). Per Ostorlab's analysis, it abuses the container manager's sandbox-extension API and runs locally inside the app sandbox, not as a network service (blog.ostorlab.co).
  • WQ Files browses, exports, edits and deletes other apps' data with no jailbreak and no kernel exploit, and was built and tested on iOS 27.0.1 (github.com/kolbicz/WQFiles). It installs through sideloading tools such as AltStore and SideStore (thehackernews.com).
  • The researcher's proof of concept lists iOS 26.0 through 26.7.2 and iOS 27.2 as affected (blog.ostorlab.co), and the iOS 27.2 entry is the only one shared with Binance's list (decrypt.co).
  • No CVE has been assigned to worse_query (thecybersecguru.com), and Apple has not published an advisory for it (blog.ostorlab.co).
  • The App Intents flaw CVE-2026-113963, which Apple fixed in iOS 27.2.1, is a separate issue; its Tenable record lists CVSS v3.1 5.5 (tenable.com). No source found confirms that it is the worse_query sandbox escape (coincentral.com).

Remediação

  • No vendor fix is confirmed for worse_query. Apple's iOS 27.2.1 and 26.7.3 updates are the general measure, but their notes do not mention the escape (thehackernews.com).
  • Delete untrusted and sideloaded apps, including WQ Files and other tools built on worse_query, and update iOS and all apps (thehackernews.com).
  • Where compromise is suspected, transfer funds to a new wallet created on a clean device and reset all active login sessions, as Binance advises (bleepingcomputer.com).
  • Avoid storing secrets in plaintext on the device, a precaution SlowMist also advises (kucoin.com).

Relatos divergentes

  • Binance and the article name iOS 26.7.1, 27.0.1 and 27.2 (bleepingcomputer.com). The proof of concept's README lists iOS 26.0 through 26.7.2 and 27.2 (blog.ostorlab.co), so the wider range is the one the researcher publishes.
  • SlowMist's security chief says iOS 27.2.1 blocks worse_query (decrypt.co). The researcher states that worse_query is not patched in iOS 27.2.1 or 27.3 beta 1 (thecybersecguru.com). Apple has not confirmed either claim, and the researcher's direct statement is the more specific source.
  • The article says the proof of concept was published 'yesterday'. The GitHub repository was created on November 8, 2026 (blog.ostorlab.co), one day before the article's date.

The research found no public commit or pull request for a worse_query fix, so this report has no Fix Details section.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 10/11/2026 12:59 · coletado 10/11 13:03 primeiro registro

    Binance warns of unpatched worse_query iOS sandbox escape that exposes crypto wallet secrets

    ler a análise desta fonte

    Binance warned on November 10, 2026 that worse_query, a publicly disclosed iOS sandbox escape, could let a malicious app read other apps' local files, exposing seed phrases, private keys and login credentials. The technique was published as a proof of concept on GitHub by the researcher forcequitOS (github.com/kolbicz/WQFiles), and developer Christoph Kolbicz built the WQ Files file manager on it to browse, edit and delete other apps' data without a jailbreak. Binance names iOS 26.7.1, 27.0.1 and 27.2, while the proof of concept's own list runs from iOS 26.0 to 26.7.2 plus 27.2. No cryptocurrency losses have been confirmed. The attack requires a malicious app already on the device, typically a sideloaded one, but no fix is confirmed: Apple's iOS 27.2.1 and 26.7.3 security notes do not mention worse_query.

    Technical Details

    • worse_query is a sandbox escape that reaches other apps' data containers, app group containers, extension data and some system locations (github.com/kolbicz/WQFiles). Per Ostorlab's analysis, it abuses the container manager's sandbox-extension API and runs locally inside the app sandbox, not as a network service (blog.ostorlab.co).
    • WQ Files browses, exports, edits and deletes other apps' data with no jailbreak and no kernel exploit, and was built and tested on iOS 27.0.1 (github.com/kolbicz/WQFiles). It installs through sideloading tools such as AltStore and SideStore (thehackernews.com).
    • The researcher's proof of concept lists iOS 26.0 through 26.7.2 and iOS 27.2 as affected (blog.ostorlab.co), and the iOS 27.2 entry is the only one shared with Binance's list (decrypt.co).
    • No CVE has been assigned to worse_query (thecybersecguru.com), and Apple has not published an advisory for it (blog.ostorlab.co).
    • The App Intents flaw CVE-2026-113963, which Apple fixed in iOS 27.2.1, is a separate issue; its Tenable record lists CVSS v3.1 5.5 (tenable.com). No source found confirms that it is the worse_query sandbox escape (coincentral.com).

    Remediation

    • No vendor fix is confirmed for worse_query. Apple's iOS 27.2.1 and 26.7.3 updates are the general measure, but their notes do not mention the escape (thehackernews.com).
    • Delete untrusted and sideloaded apps, including WQ Files and other tools built on worse_query, and update iOS and all apps (thehackernews.com).
    • Where compromise is suspected, transfer funds to a new wallet created on a clean device and reset all active login sessions, as Binance advises (bleepingcomputer.com).
    • Avoid storing secrets in plaintext on the device, a precaution SlowMist also advises (kucoin.com).

    Conflicting Reports

    • Binance and the article name iOS 26.7.1, 27.0.1 and 27.2 (bleepingcomputer.com). The proof of concept's README lists iOS 26.0 through 26.7.2 and 27.2 (blog.ostorlab.co), so the wider range is the one the researcher publishes.
    • SlowMist's security chief says iOS 27.2.1 blocks worse_query (decrypt.co). The researcher states that worse_query is not patched in iOS 27.2.1 or 27.3 beta 1 (thecybersecguru.com). Apple has not confirmed either claim, and the researcher's direct statement is the more specific source.
    • The article says the proof of concept was published 'yesterday'. The GitHub repository was created on November 8, 2026 (blog.ostorlab.co), one day before the article's date.

    The research found no public commit or pull request for a worse_query fix, so this report has no Fix Details section.