An unpatched iOS sandbox flaw called worse_query lets a malicious app read files that belong to other apps on your iPhone, and Binance has warned that it could expose seed phrases, private keys and login credentials. Apple’s iOS 27.2.1 update, released on November 9, does not fix it, and the researcher who published the proof of concept says iOS 27.3 beta 1 does not either.
Security researcher forcequitOS disclosed the flaw and published a proof of concept on GitHub. Binance posted its warning on November 10 and says the problem sits in iOS itself and is not unique to Binance.
iOS Sandbox Flaw Reaches App Data
iOS keeps each app inside a sandbox so it can only read its own data. The worse_query proof of concept gets out of that sandbox and reaches the data containers of other apps on the phone, with a few paths that work only on iOS 27.
An app has to set up an App Group container before it can use worse_query. The researcher describes the code as a proof of concept for developers that is not useful by itself, and says it has nothing to do with a jailbreak.
Binance names iOS 26.7.1, iOS 27.0.1 and iOS 27.2 as affected, while the researcher says worse_query works on every release from iOS 26.0 through iOS 26.7.2 plus iOS 27.2. The researcher also says iOS 27.2.1 is unpatched, so an iPhone on the latest public release can still be exposed.
What Binance Tells iPhone Users
Binance tells you to delete apps installed from untrusted sources, such as sideloaded or manually signed IPA files, and to update iOS and all your apps to the latest official versions. Updating to iOS 27.2.1 will not close this hole, because the flaw is still unpatched there. If you suspect a breach, Binance says to move your funds to a new wallet created on a clean device and to reset all active login sessions.
forcequitOS says an App Store app could use worse_query too, as long as it passes App Review. App Review has missed crypto-stealing apps before, including a fake Bitcoin wallet that three customers say cost them $1.8 million.
Apple Has Not Patched It
Apple does not confirm security issues until a patch is available. The nine fixes in iOS 27.2.1 cover iMessage, Bluetooth and AirPlay bugs, and worse_query is not one of them. The researcher says the iOS 27.3 beta 1 build from November 3 is unpatched too, and forcequitOS plans to update the supported versions on GitHub once Apple ships a fix.
iPhones that still run iOS 18 face a separate crypto wallet threat, the P7 DarkSword spyware variant, which pulls Keychain data and extracts data from the imToken wallet app. Its operators control it remotely and can download any file from the phone.
