“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem,” Binance says.
Binance’s warning and immediate user guidance
Binance alerted users that the problem exists at the iOS level and is not limited to the Binance app. The exchange said no cryptocurrency losses have been confirmed so far but urged users to treat the situation as a serious, cross‑application risk and to install updates immediately as a precaution.
Binance’s advice is specific: delete any unnecessary or untrusted apps, update iOS and other apps to their latest versions, and—where compromise is suspected—transfer funds to a new wallet created on a clean device and reset all active login sessions.
What worse_query does and how WQ Files demonstrates it
“worse_query” is described as a publicly disclosed iOS sandbox escape technique that allows an application to cross security boundaries and access the storage of other applications. A proof‑of‑concept exploit published yesterday uses a tool called WQ Files to apply that technique in practice.
According to the reporting, WQ Files leverages worse_query to browse, export, edit, and delete other apps’ data without requiring a jailbreak. That capability directly maps to the risks Binance highlighted—seed phrases, private keys, and login credentials stored by one app could be read or exfiltrated by another app exploiting the technique.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVersions confirmed vulnerable and Apple’s November 9 updates
WQ Files has been confirmed to work on iOS 26.7.1, 27.0.1, and 27.2 — the same versions Binance warned about. In response, Apple on November 9 released security updates (iOS 27.2.1, 26.7.3, and 18.7.12) that address nine flaws.
One of the fixes is tracked as CVE‑2026‑113963 and is described as a vulnerability that could allow an app to access sensitive user data. It remains unclear whether CVE‑2026‑113963 is the same security issue Binance flagged.
The CVE was reported by László Várady, who found that the data access occurred through App Intents rather than App Group containers. BleepingComputer has contacted Apple for clarifications and said it will add an update once Apple responds.
Distribution, attack prerequisites, and the sideloading vector
The published proof‑of‑concept shows the tool must be installed on an iPhone for the attack to work. Because WQ Files does not require a jailbreak, an attacker could distribute it through untrusted sources as a sideloaded app, thereby bypassing Apple’s App Store controls.
That distribution vector is central to the practical risk: the exploit’s technical capability to cross app storage boundaries is paired with an installation requirement that an attacker can meet outside official app‑store channels, according to the reporting.
What this means for end users, technologists, and exchanges
- End users and cryptocurrency holders: follow Binance’s steps—install the latest iOS updates, remove untrusted or unnecessary apps, and if compromise is suspected, create a new wallet on a clean device and move funds there. The exchange specifically recommends resetting active login sessions.
- Technologists and security teams: the existence of a public proof‑of‑concept (WQ Files) implementing worse_query raises the bar on urgency for device hygiene and monitoring for sideloaded software. The technical note that the CVE report involved App Intents rather than App Group containers may focus triage and testing on inter‑app intent handling as well as file‑storage protections.
- Exchanges and app developers: because Binance describes the flaw as an iOS‑level issue, developers should assume that secrets stored locally—seed phrases, private keys, stored credentials—can be exposed if a device is compromised, and plan mitigations that include minimizing sensitive local storage and guiding users through device‑recovery steps when compromise is suspected.
The core facts are straightforward and urgent: a sandbox escape technique labeled worse_query is publicly demonstrated, the WQ Files proof‑of‑concept works on specific iOS releases, and both Binance and Apple have taken public steps—Binance with user advisories, Apple with security updates—to respond. Whether the CVE‑tracked fix announced by Apple on November 9 maps exactly to the worse_query exploit remains unresolved; BleepingComputer has sought clarification from Apple and will report further updates when available.
