Pierluigi Paganini
November 10, 2026
On 10 November, Binance warned users about a public iOS sandbox escape that lets one app read the files of other apps. Seed phrases, private keys and login credentials could be exposed to a malicious app, the exchange said.
“A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.” reads the warning.
Binance advises users to remove apps installed from untrusted sources, update iOS and all apps to the latest official versions, and, if a breach is suspected, move funds to a new wallet on a clean device and reset all active login sessions.
A researcher known as ‘forcequitOS’ published the PoC exploit code, called worse_query, on GitHub. Apple released security updates for both iOS versions the following day, but its release notes mysteriously don’t report a fix for the issue. The good news is that neither Binance nor the researcher has reported any attacks or data theft.
“worse_query is the direct successor to bad_query and essentially replaces it. To use worse_query, you’ll have to set up an App Group container for your app.” forcequitOS wrote.
The proof-of-concept can access the data folders used by all apps and, on iOS 27, some system folders as well. To work, an app must create an App Group container. The researcher says the code is intended for developers and “isn’t useful by itself.” However, other developers have already used it to build apps that can be installed on iPhones.
One example is WQ Files, a file manager developed by Christoph Kolbicz, TheHackerNews reports.
“WQ Files is a file browser, app data manager and cache cleaner for iOS 26 and 27. “WQ” stands for worse_query, the sandbox technique it is built on. It reaches other apps’ and system containers with no jailbreak and no kernel exploit. Tested on iOS 26.7.1, 27.0.1 and 27.2.” reads the description.
It can access data belonging to other apps without requiring a jailbreak or a kernel exploit. It can also edit, delete and clear that data. Users can install it through sideloading tools such as AltStore and SideStore, which automatically create the required App Group when users sign in with their Apple ID.
The forcequitOS says they have no intention of seeking a bug bounty from Apple and are willing to give up any potential reward because of Apple’s delayed response and the inappropriate behavior of people publicly misusing or exaggerating the exploit.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Apple)
Breaking News / November 10, 2026
