Discover how the iOS sandbox escape vulnerability could expose crypto wallet secrets and learn Binance's security recommendations for affected iPhones.
Article produced with artificial intelligence systems and published under the editorial responsibility of Amelia Tomasicchio. How we work
On November 10, 2026, Binance issued a warning stating that a vulnerability dubbed worse_query, which allows an iOS sandbox escape, enables apps to access other apps’ files on iPhones running iOS 26 and 27, which could expose crypto wallet secrets. Apple’s updates released a day earlier do not list a fix, and no patch for the escape has been confirmed.
Summary
Key takeaways
- worse_query can expose wallet keys, seed phrases and login credentials.
- WQ Files uses the escape to change other apps’ data without a jailbreak.
- Neither Binance nor the researcher reported related attacks or thefts.
- Binance recommends removing untrusted apps and updating device software.
How the iOS sandbox escape vulnerability affects wallets
The worse_query proof of concept can reach every app’s data container on an affected iPhone, plus some system folders on iOS 27. Binance cautioned that such access could expose seed phrases, private keys and login credentials to malicious apps.
The reported scope covers iOS 26 and 27, although the available testing records differ. Binance’s warning cites the same three versions that the WQ Files release notes list as tested, whereas the researcher points to a wider set of affected versions.
Binance, the researcher and the developers building apps around the escape did not identify a specific wallet app as exposed. Neither the exchange nor the researcher reported attacks or thefts involving worse_query.
Binance’s advice for iPhone users
Binance advised users to delete apps sourced from untrusted channels, such as sideloaded or manually signed apps, and to update iOS and all installed apps. Its warning also gives additional steps for anyone who suspects a breach.
Those users should move funds into a new wallet created on a clean device and reset all active login sessions, the exchange advised. The recommendation to install updates comes despite the absence of a confirmed fix for this particular escape.
Proof of concept powers WQ Files
Security researcher forcequit published worse_query on GitHub on Sunday, a day before Apple released its updates. An app needs an App Group container to use the escape.
Developer Christoph Kolbicz built WQ Files using worse_query. The sideloaded file manager can access, edit, delete and clear other apps’ data without a jailbreak or kernel exploit.
WQ Files installs through tools including AltStore and SideStore. When used with an Apple ID, those tools automatically create the App Group container the exploit requires.
In a reply on X, forcequit said the early release had not been planned. The researcher wrote that “Apple was stalling on responding to me and people started larping with it on here.”
Apple’s updates list no sandbox fix
Apple’s security notes for iOS 26.7.3 and iOS 27.2.1, released on November 9, 2026, mention neither worse_query nor sandbox issues. Those notes do not establish that the iOS sandbox escape vulnerability has been fixed.
The available version records also have limits: only Erosion’s developers list iOS 27.2.1, while none of the cited projects lists iOS 26.7.3.
Apple’s notes say it does not disclose security issues until it has investigated them and a patch or release is available. The November 9 updates addressed two iMessage flaws and several Bluetooth bugs.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
