A claimed break in app isolation
In a security advisory, Binance warned that malicious software exploiting iOS vulnerabilities could access sensitive information across applications. The exchange specifically identified private keys, seed phrases and login credentials as data that could be exposed, and urged affected users to remove the implicated application, update iOS and, where appropriate, move assets to a new wallet on a clean device.
The warning is important because mobile wallets depend on application sandboxing. This is the operating system’s security boundary that is supposed to keep one application from opening another application’s private files. If that boundary can be bypassed, an app installed for an apparently unrelated purpose could potentially inspect wallet databases, backups or authentication files stored locally on the same iPhone.
Binance’s warning identified worse_query as affecting iOS 26.7.1, iOS 27.0.1 and iOS 27.2. It described the problem as an iOS level issue that could affect the wider ecosystem, including other cryptocurrency wallets, exchanges and trading applications.
The warning did not establish that Binance accounts or user funds had been compromised. It also did not provide a CVE identifier, a confirmed list of affected applications or evidence that the technique has been used in a real world attack. Those gaps make it difficult to assess the vulnerability’s prevalence and practical severity.
What the public proof of concept shows
The researcher’s public worse_query repository describes the technique as an iOS 26 and iOS 27 sandbox escape. According to the repository, the proof of concept can access other applications’ data containers as well as certain system paths.
The project also says the technique requires an App Group container. That qualification matters. It suggests that a malicious application may need to satisfy particular conditions before it can use the technique, rather than gaining unrestricted access simply by being installed. The repository characterizes the work as a proof of concept, so its existence does not by itself demonstrate that every iPhone running the listed versions is equally exposed.
Even with that limitation, the potential consequences are serious for crypto users. A seed phrase stored in a note, wallet backup or local file can provide complete control over the associated assets. A private key can offer the same authority without requiring a user to approve a new transaction. Login credentials could also enable account takeover, particularly if users reuse passwords or store authentication data in application files.
The issue therefore goes beyond the security of one exchange. Wallet providers can protect their code, but they still rely on the mobile operating system to enforce isolation between applications. A weakness in that foundation could affect different products that use separate security models but share the same device.
Researchers describe the technique as a container escape
SlowMist Chief Information Security Officer 23pds said in posts on X that worse_query is a container sandbox escape rather than a jailbreak. He said the technique does not automatically steal assets, but a malicious app installed from an untrusted source could read other applications’ containers and expose wallet data stored in plain text.
That distinction is relevant for users deciding how urgently to respond. A sandbox escape is not necessarily an automatic drain mechanism. An attacker would still need to install or persuade a victim to install malicious software, locate valuable files and use any recovered information to access accounts or wallets. However, crypto assets are especially sensitive because possession of a seed phrase or private key can remove the need to bypass additional transaction controls.
A separate project provides an indication of what the technique may enable in practice. Developer Christoph Kolbicz’s Worse Query Files releases describe a file manager that can browse, back up, edit and restore data belonging to other applications on iOS 27. The releases report testing on iOS 27.0.1.
That reported functionality illustrates the difference between an abstract vulnerability and a practical tool. If an application can browse another app’s data container, it may be able to expose files that users assumed were protected by iOS. Whether a particular wallet stores secrets in readable form, encrypts them properly or keeps them outside the device would determine the actual impact.
Apple’s public release information has not identified it
Apple’s security releases page lists iOS 26.7.1 and iOS 27.0.1, but, at the time checked, it did not identify worse_query or provide a CVE entry for the alleged issue. The supplied source material does not identify an Apple statement confirming, rejecting or fully addressing the claim.
That leaves the status of a fix unclear. Updating iOS remains a standard defensive measure, but users cannot yet determine from Apple’s listed security notes whether a patch specifically closes this technique. The mention of iOS 27.2 in Binance’s warning also raises questions about whether that version is affected, whether it represents a separate configuration and how the version numbers relate to Apple’s published releases.
Only one side of the dispute was found in the material reviewed for this report. Binance, the researcher and the security specialist support the warning, while no opposing technical assessment or public denial from Apple appears in the supplied sources. The available evidence therefore supports treating the claim as a serious unconfirmed vulnerability, not as a verified mass compromise.
Until more details emerge, users should avoid installing unfamiliar applications, especially software promoted through unsolicited links or unofficial distribution channels. Anyone who has installed the application identified in Binance’s advisory should consider removing it and following Binance’s recommendation to update iOS. Users who believe a seed phrase or private key may have been exposed should treat the wallet as compromised and move funds using a new wallet created on a clean device.
- homeland411.com · Link preview (og:image)
- Rafael Fernandez · CC BY-SA 4.0
Jessica Jones is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Jessica Jones's usual length and in Jessica Jones's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 11/10/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.