GoKawiilBinance warns iOS sandbox flaw 'worse_query' could expose crypto wallet keys
Binance alerted users to a vulnerability affecting iOS 26.7.1, 27.0.1, and 27.2, dubbed 'worse_query,' that lets malicious apps read private files from other apps, including seed phrases, private keys, and login credentials. A public proof-of-concept tool called WQ Files can exploit this without jailbreaking, though it requires sideloading onto a device. Apple issued patches on November 9 (iOS 27.2.1, 26.7.3, 18.7.12) addressing a related flaw, CVE-2026-113963.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the flaw sits at the operating-system level rather than within any single app, it could threaten crypto holders broadly, not just Binance users, until devices are updated. The existence of a working public exploit tool raises the urgency, since attackers could distribute it outside the App Store to bypass Apple's usual vetting.
- A sandbox escape bug in iOS 26.7.1, 27.0.1, and 27.2 can let malicious apps read other apps' private data.
- A public tool, WQ Files, already demonstrates the exploit without needing a jailbroken device.
- Apple patched a related vulnerability on November 9; Binance urges immediate updates and fund transfers if compromise is suspected.
Ledger Nano X Hardware Wallet — Given this iOS vulnerability exposing seed phrases and private keys stored on phones, a hardware wallet keeps your crypto credentials offline and isolated from any app-level exploit. The Ledger Nano X lets you manage assets via Bluetooth or USB while your private keys never touch your phone's storage, sidestepping exactly this kind of sandbox escape risk.”.
See Ledger Nano X Hardware Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-10
Published there as: “Binance warns of iOS flaw that could leak crypto wallet secrets”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.