Public iOS sandbox exploit can expose data across apps

Binance warned on 10 November 2026 about a public iOS sandbox escape that could allow one app to read files belonging to other apps, potentially exposing seed phrases, private keys and login credentials across the iOS ecosystem. The firm stated that a vulnerability (worse_query) affects iOS 26.7.1, 27.0.1 and 27.2, describing it as an iOS‑level issue not unique to Binance.

Binance advised users to remove apps installed from untrusted sources, to update iOS and all apps to the latest official versions, and to move funds to a new wallet on a clean device and reset active sessions if a breach is suspected. The warning was attributed to the Binance account on X (formerly Twitter).

A researcher known as ‘forcequitOS’ published a PoC exploit called worse_query on GitHub, with Apple releasing security updates for iOS 26.7.1, 27.0.1 and 27.2 the following day, though Apple’s release notes did not explicitly report a fix for this issue. The researcher described worse_query as the direct successor to bad_query and noted that it requires an App Group container to function; the PoC can access data folders used by all apps and, on iOS 27, some system folders as well.

The tool has been used by developers to build apps such as WQ Files, a file browser and data manager for iOS 26 and 27, which can access other apps’ data without a jailbreak or kernel exploit. The article notes that neither Binance nor the researcher reported attacks or data theft at the time.