Binance Warns of Unpatched iOS Sandbox Flaw That Exposes App Files

Binance warned iPhone owners on 10 November 2026 about an iOS sandbox flaw, nicknamed worse_query, that can let a malicious app read files stored by other apps. The exchange lists iOS 26.7.1, 27.0.1 and 27.2 as affected, and researchers say the hole is still open on the newest release, iOS 27.2.1.

That matters beyond crypto. iOS keeps each app in a private container, and this bug breaks that wall without a jailbreak.

What the iOS sandbox flaw does

Two security researchers found the issue and posted proof-of-concept code on GitHub. A rogue app built on it can reach outside its own sandbox and open files that belong to other apps. Binance says that could expose wallet seed phrases, private keys and saved login details if an app stores them in plain local files.

Other developers have already turned the code into a file manager called WQ Files. According to 9to5Mac and Bitdefender, it can browse, export, change and even delete other apps' data on an unmodified iPhone.

There is one big limit. The malicious app has to be installed first. Nobody has shown a way to trigger the bug from a website or a message, so the main risk comes from sideloaded apps and manually signed IPA files.

Is it fixed in iOS 27.2.1?

Probably not. Apple shipped iOS 27.2.1 and iOS 26.7.3 on 9 November 2026, the day before Binance spoke up. We covered that release in our iOS 27.2.1 security fixes story, and its notes include an App Intents bug that let an app reach sensitive user data. Apple's advisory doesn't mention worse_query by name, though, so it isn't clear the two are related.

One of the researchers told 9to5Mac that the flaw still works on iOS 27.2.1 and on the first iOS 27.3 beta. Apple hasn't commented publicly. Binance itself calls it an iOS-level problem, not something specific to its own app.

What iPhone owners should do now

• Install the latest update anyway (Settings, General, Software Update). It closes nine other holes.
• Delete any app you didn't get from the App Store or a source you trust.
• Don't keep recovery phrases in screenshots, Notes or other plain files.
• If you think a bad app was on your phone, Binance suggests creating a fresh wallet on a clean device, moving funds there and signing out of active sessions.

Also be careful with messages that "warn" you about this bug and ask for a recovery phrase. No real wallet provider will ask for one.

Our Opinion

This is a serious design-level slip, but the panic should be measured. Most people only install apps from the App Store, and Apple's review would have to miss an app built around a public exploit for it to reach them. The people most exposed are those who sideload apps or keep a hot wallet with its keys sitting in local storage. For them, the advice is simple: clear out unknown apps and move any large balance to a hardware wallet. What bothers us more is the silence. Apple usually ships a quick fix once proof-of-concept code is public, and an iOS 27.2.2 with a clear advisory would settle the question. Until that arrives, treat every unfamiliar app as a risk.

Have you sideloaded any apps on your iPhone this year? Tell us in the comments below, and stay tuned to Phone Opinions for Apple's fix when it lands.

Source: 9to5Mac, Bitdefender, Binance

FAQ

What is the worse_query iOS flaw?

It is a sandbox escape that lets a malicious iPhone app read, and in some cases change, files belonging to other apps without a jailbreak. Researchers published proof-of-concept code for it in November 2026.

Which iOS versions are affected by worse_query?

Binance names iOS 26.7.1, 27.0.1 and 27.2. Researchers say iOS 27.2.1 and the first iOS 27.3 beta are still vulnerable, and Apple has not confirmed a fix.

Can the flaw steal data from my iPhone through a website?

No method like that has been shown. An attacker first needs you to install a malicious app, which is why deleting untrusted or sideloaded apps is the main defence.