worse_query is an iOS vulnerability (a sandbox escape, meaning a break in the barrier that keeps each app walled off from the others) published on GitHub on November 8, 2026. It lets a malicious app already installed on the phone read the data folders of other apps. On November 10, Binance warned that seed phrases, private keys and login credentials are at risk.

Binance is one of the largest cryptocurrency exchanges in the world. Its warning came in a tweet that revived a worry iPhone owners with crypto wallets already knew well. The company was careful to say the problem lies in iOS and not in its own products, calling it "an iOS-level issue, not unique to Binance". The versions it names are iOS 26.7.1, 27.0.1 and 27.2.

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:
- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
- Update iOS and all apps to the latest official versions.
- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

— Binance (@binance) November 10, 2026

A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.

Immediate Action Required:
- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
- Update iOS and all apps to the latest official versions.
- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

What worse_query is and how it works

worse_query is the name of a repository published by a developer who goes by forcequitOS on GitHub. The project is described as "a sandbox escape for iOS 26 and 27, again" and appeared on November 8, 2026. As of November 10 it had 413 stars and 83 forks under a GPL-3.0 license (figures read from the GitHub API). It is the direct successor to bad_query, released in August, and in practice takes its predecessor's place.

The sandbox is the rule that stops one app from touching another app's private files, so your bank app can't read your notes and a game can't open your crypto wallet. With worse_query, that wall can be bypassed under certain conditions. The README lists the reachable paths, including application data folders (/var/mobile/Containers/Data/Application/*), plugin folders and containers shared between apps from the same developer. On iOS 27, system areas are reachable too.

The author hedges. He calls it a proof of concept "for developers" that is "not useful on its own", since using it means configuring an App Group (a container shared between apps, normally meant for swapping data between an app and its extensions) for your own app. He adds that it has nothing to do with jailbreaking and never will. The code, however, did not stay a lab exercise. At least two projects built on top of it already exist on GitHub, one of them pitched as a native file browser for iOS.

What crypto wallet owners on iPhone stand to lose

The damage depends on how each app stores its secrets. A wallet that keeps its recovery phrase (a seed phrase, the 12 or 24 words that unlock the funds) or its private key in a readable file exposes everything to anyone who can read that folder. SlowMist's head of security, quoted by Cryptonews, makes the same point. SlowMist is a blockchain security firm, and he says the flaw undermines the idea that app containers are truly separate.

That is why the danger goes beyond crypto. Login sessions, tokens and documents saved locally all live in the same folders. Binance talks about seed phrases and keys because money is the fastest target to cash out, but an email app or a password manager that leaves plain data on the phone is in the same position.

The starting condition has been the same since day one, and there is only one. A malicious app has to be on the device. That is why Binance keeps pointing at apps from untrusted sources, such as apps loaded outside the App Store or signed by hand (IPA files). In the European Union, where the Digital Markets Act (DMA) opened the door to alternative stores, that channel exists legally, but reputable marketplaces run checks, and the bigger risk comes from packages downloaded from anonymous sites and groups.

Which versions are affected and what Apple says

Here the numbers don't quite add up, so it is worth keeping that in mind before trusting any single list. Binance names three releases, while the repository names a wider range. Apple, meanwhile, has shipped two new updates.

Apple released iOS 27.2.1 and 26.7.3 on November 9, the day after the code appeared on GitHub. The official security content page lists entries for both. According to Decrypt, the 27.2.1 notes list nine fixed vulnerabilities, including an authorization issue in App Intents, but do not mention worse_query. Cupertino, for its part, has not said whether the new update closes that hole. The one party willing to say so is SlowMist's security team, which urges users to update to iOS 27.2.1 and believes the escape is blocked. That is one expert's opinion, not a confirmation from the vendor.

Anyone still on iOS 26 has the longer road. 26.7.3 shipped alongside 27.2.1, yet no source we consulted says explicitly what it fixes with respect to worse_query. For the other changes in the latest update, see our piece on iOS 27.2.1.

Limitations to keep in mind

  • No cryptocurrency theft has been attributed to worse_query. The risk Binance describes is potential, so the alarm matters to anyone with a wallet on their phone but is not evidence of attacks in progress.
  • The published code is a proof of concept, "not useful on its own" by its author's own admission. Anyone using it to steal data would also need a malicious app to get the victim to install. That narrows the pool of people who can be hit to those who install software of dubious origin.
  • The list of vulnerable versions changes from source to source (three releases for Binance, a range from 26.0 to 26.7.2 plus 27.2 for the author). Nobody has independently verified yet whether 27.2.1 and 26.7.3 fix the problem. Until Apple says so in writing, updating reduces exposure but does not eliminate it with certainty.

What to do now

Binance's advice comes in three parts and all of it points the same way. First, delete apps that came from untrusted sources, especially those loaded outside the Store or signed manually. Then update iOS and every app to the latest official versions (today that means 27.2.1 or 26.7.3). Finally, anyone who suspects a breach should move funds to a new wallet created on a clean device and end all active login sessions.

We would add two precautions of our own, drawn from how the bug works. Don't keep your recovery phrase in notes, screenshots or text files on the phone, because those are exactly the places a folder read can reach. And for serious money, a hardware wallet (a physical device that signs transactions without ever revealing the key) is worth it, because the key never sits in the iPhone's memory.

Not the first wallet alarm for iPhone

The past two months brought other cases like this, all different from this one. In September, SlowMist exposed FomoPeek, an app that stole crypto keys by exploiting a kernel flaw. On the DarkSword front, the exploit chain that hit iPhones running outdated iOS, we covered the Instagram ad that led to the spyware, Google's report on the attackers' domains and SlowMist's assessment of iOS 26.5, which we judged unproven. Early November also saw a jailbreak that beats Lockdown Mode and survives iOS 27.2. A sandbox escape shows up in every one of these episodes. The common thread never changes, and it is that the update arrives and the user installs it late.

Frequently asked questions

The risk drops a lot, but no source brings it to zero. Binance names apps from untrusted channels as the source of the danger. Nothing we have read describes Store apps abusing the bug. Updating iOS and removing what you don't need remains the most concrete protection.

Apple has not confirmed it. The 27.2.1 security notes don't mention worse_query, while SlowMist's head of security says the update blocks the sandbox escape. Until there is official confirmation, install it anyway.

Far less than a software wallet. A hardware device's private key is not in the iPhone's folders, so reading them doesn't reveal it. The credentials of any linked apps, an exchange app for instance, remain at risk.

Binance's advice applies to anyone who suspects a breach. If you have only installed Store apps and updated your phone, nothing suggests a transfer is needed. If you have tried hand-signed software, it is better to create a new wallet from a clean device.

A public vulnerability, code that others are already rewriting, an exchange sounding the alarm before the phone's maker does. Updating costs little. Do it before someone finds the right app to install.

Corrections and replies

Spotted an error, a typo or information that needs updating? Let us know. People and companies mentioned in our articles can also request a correction or send a reply. We review every request within 48 business hours and, if it is well founded, we publish the correction or the reply at the end of the article, as set out in our corrections policy.

Enjoyed the article?

Related Articles

Stay updated

Subscribe to the newsletter to receive new articles directly in your inbox.

Request a quote