On 10 November 2026 Binance warned iPhone users about worse_query, an iOS flaw that it says "allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk". Binance stressed that it is "an iOS-level issue, not unique to Binance".
What it is: a researcher posting as forcequitOS published worse_query on GitHub on 8 November as "a proof-of-concept for developers" and the successor to an earlier technique, bad_query. It is a sandbox escape, not a jailbreak: an app built with it can reach other apps' data containers, extension data and shared App Group storage. A developer, Christoph Kolbicz, has already released a file manager built on it that can browse, back up and edit other apps' data on iOS 27 without a jailbreak.
Which versions: Binance names iOS 26.7.1, 27.0.1 and 27.2; the researcher's README lists a wider range, iOS 26.0 to 26.7.2 and 27.2. Apple released iOS 27.2.1 and 26.7.3 on 9 November, but its security notes do not mention worse_query or a sandbox escape, so it is not confirmed whether these updates block it. No CVE has been named.
How big is the risk? The attack needs the user to install an app from outside the App Store (a sideloaded or manually signed IPA). Security firm SlowMist told Bitcoin Magazine the flaw will not steal assets on its own; the danger is a wallet that keeps recovery phrases, keystores or WebView caches in plain files on the phone. Hardware wallets keep keys off the phone. Neither Binance nor the researcher has reported any theft linked to worse_query.
