Binance warns of worse_query iOS sandbox escape that could expose crypto wallet keys; no Apple fix confirmed
Binance warned users that the public worse_query iOS sandbox escape lets an app read other apps' files on iPhones running iOS 26 and iOS 27, which could expose seed phrases, private keys and login credentials to malicious apps. The proof of concept was published on GitHub on Sunday, November 8, 2026, by the researcher forcequit (forcequitOS), a day before Apple released iOS 27.2.1 and iOS 26.7.3. Apple's notes for those releases do not mention worse_query or any sandbox issue, and no fix has been confirmed (thehackernews.com). Neither the exchange nor the researcher has reported any attacks or thefts, and the code is aimed at developers. Exploitation therefore depends on a malicious app already being installed on the device.
Detalhes técnicos
The repository describes worse_query as a proof of concept that succeeds bad_query and reaches application data containers, shared app-group containers and some system paths on iOS 27 (github.com/forcequitOS/worse_query). According to the article, a calling app must first create an App Group container, and the proof of concept is described as not useful on its own (thehackernews.com). WQ Files, a file manager built by developer Christoph Kolbicz, uses the technique without a jailbreak or kernel exploit to read, edit, delete and clear other apps' data, and it installs through sideloading tools such as AltStore and SideStore (thehackernews.com). No party has said whether an App Store app could use the technique (thehackernews.com).
Remediação
Binance advises deleting apps installed from untrusted sources, such as sideloaded or manually signed apps, and updating iOS and every app (thehackernews.com). Users who suspect a breach should move funds to a new wallet created on a clean device and reset all active login sessions (thehackernews.com). Because no fix has been confirmed, the iOS 27.2.1 and 26.7.3 updates should not be assumed to close the issue.
Relatos divergentes
The article describes the researcher's tested range as wider than the three iOS versions in Binance's warning (thehackernews.com). The worse_query README lists iOS 26.0 to 26.7.2 and 27.2 as supported (github.com/forcequitOS/worse_query), so that primary source is used for the version range. The article is the only source listing iOS 27.2.1 for the technique, through the Erosion developers' README change (thehackernews.com).
Linha do tempo
-
Binance warns of worse_query iOS sandbox escape that could expose crypto wallet keys; no Apple fix confirmed
ler a análise desta fonte ocultar
Binance warned users that the public worse_query iOS sandbox escape lets an app read other apps' files on iPhones running iOS 26 and iOS 27, which could expose seed phrases, private keys and login credentials to malicious apps. The proof of concept was published on GitHub on Sunday, November 8, 2026, by the researcher forcequit (forcequitOS), a day before Apple released iOS 27.2.1 and iOS 26.7.3. Apple's notes for those releases do not mention worse_query or any sandbox issue, and no fix has been confirmed (thehackernews.com). Neither the exchange nor the researcher has reported any attacks or thefts, and the code is aimed at developers. Exploitation therefore depends on a malicious app already being installed on the device.
Technical Details
The repository describes worse_query as a proof of concept that succeeds bad_query and reaches application data containers, shared app-group containers and some system paths on iOS 27 (github.com/forcequitOS/worse_query). According to the article, a calling app must first create an App Group container, and the proof of concept is described as not useful on its own (thehackernews.com). WQ Files, a file manager built by developer Christoph Kolbicz, uses the technique without a jailbreak or kernel exploit to read, edit, delete and clear other apps' data, and it installs through sideloading tools such as AltStore and SideStore (thehackernews.com). No party has said whether an App Store app could use the technique (thehackernews.com).
Remediation
Binance advises deleting apps installed from untrusted sources, such as sideloaded or manually signed apps, and updating iOS and every app (thehackernews.com). Users who suspect a breach should move funds to a new wallet created on a clean device and reset all active login sessions (thehackernews.com). Because no fix has been confirmed, the iOS 27.2.1 and 26.7.3 updates should not be assumed to close the issue.
Conflicting Reports
The article describes the researcher's tested range as wider than the three iOS versions in Binance's warning (thehackernews.com). The worse_query README lists iOS 26.0 to 26.7.2 and 27.2 as supported (github.com/forcequitOS/worse_query), so that primary source is used for the version range. The article is the only source listing iOS 27.2.1 for the technique, through the Erosion developers' README change (thehackernews.com).