iOS Sandbox Escape 'worse_query' Raises Crypto Wallet Security Concerns Amid Binance Alert

Cryptocurrency exchange Binance issued a public warning on November 10, 2026, highlighting an iOS vulnerability dubbed 'worse_query' that could allow malicious sideloaded apps to read files from other applications, potentially exposing wallet seed phrases, private keys, and login credentials. The flaw affects iOS versions including 26.7.1, 27.0.1, and 27.2, representing a sandbox escape rather than a full jailbreak. Blockchain security firm SlowMist had flagged the issue earlier that day, noting it enables cross-app data access if sensitive information is stored unencrypted locally. An independent researcher operating as forcequitOS publicly released a proof-of-concept on GitHub on November 8, crediting collaborator 0xjohnny and describing it as a successor to an earlier technique called bad_query. Apple released iOS 27.2.1 and 26.7.3 on November 9, though security notes do not explicitly reference the flaw, and researcher statements indicate it may remain unpatched in the initial update. Multiple outlets including Cointelegraph, BleepingComputer, Decrypt, and Bitcoin Magazine corroborated the details, with Binance emphasizing no confirmed thefts tied to the bug to date. The risk is heightened for users who sideload apps outside the App Store, as the exploit requires a malicious app to already be installed and running. This incident echoes prior concerns, such as the September 2026 FomoPeek app incident linked to crypto thefts via sandbox escapes. Experts recommend avoiding untrusted IPAs, updating to the latest iOS, encrypting wallet data where possible, and migrating funds to new wallets on clean devices if compromise is suspected. The episode underscores broader ecosystem risks for mobile crypto storage, potentially accelerating shifts toward hardware wallets or self-custody best practices.