Cryptocurrency platform Binance warned its users of a critical security vulnerability affecting several versions of Apple's mobile operating system, iOS, specifically versions 26.7.1, 27.0.1, and 27.2. This vulnerability allows malicious applications and third parties to read private files stored by other applications on the same device.
The platform explained that the issue lies at the operating system level itself and is not limited to the Binance application alone, posing a potential risk to the entire ecosystem. Data at risk includes seed phrases, private keys for digital wallets, and sensitive login data.
Nature of the Vulnerability and Sandbox Escape Technology
The discovered vulnerability, known as a sandbox escape technique and named "worse_query," relies on bypassing iOS security boundaries and enabling any application to browse, export, modify, and delete data from other applications without the need for jailbreak operations.
Recently, an attack proof-of-concept using a tool called "WQ Files" to execute these attacks appeared. This tool requires installation on an iPhone for an attacker to exploit it, and it is often distributed through untrusted sources such as sideloaded applications that bypass the Apple App Store.
Apple's Response and Security Updates
Apple recently released security updates to address several software vulnerabilities, including a vulnerability registered under the identifier CVE-2026-113963, which allows an application to access sensitive user data. Although it is not yet officially confirmed whether this presented vulnerability is the same one warned about by Binance, security researchers indicated that the access path is through "App Intents" technologies.
What Does This Practically Mean for Users?
So far, no cases of theft or loss of digital funds have been confirmed as a result of this vulnerability, but Binance urged users to take immediate preventative measures including:
- Installing the latest iOS system updates issued by Apple immediately.
- Deleting any unnecessary or untrusted applications from the devices.
- In case a breach is suspected, the platform advises transferring digital assets to a new wallet created on a completely clean device.
- Resetting all active login sessions for various accounts.