Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

Binance warns iOS flaw can leak wallet secrets to other apps

Original title: Binance warns of iOS flaw that could leak crypto wallet secrets

BleepingComputerby Bill Toulas ()2 min read
Read at bleepingcomputer.com
Part of a story covered by 4 sourcesBinance warns public iOS sandbox escape can expose wallet filesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A public WQ Files proof of concept reads other apps' data on iOS 26.7.1, 27.0.1, and 27.2; no crypto losses are confirmed.

Binance says an iOS issue it calls worse_query lets malicious apps read other apps' local files, including seed phrases, private keys, and credentials, on iOS 26.7.1, 27.0.1, and 27.2. The flaw is not limited to Binance. A public tool, WQ Files, can browse, export, edit, and delete other apps' data without a jailbreak if sideloaded. Apple's November 9 updates fix nine flaws, including CVE-2026-113963, but it is unclear whether that identifier matches worse_query. No cryptocurrency losses are confirmed.

Unconfirmed: It is unclear whether CVE-2026-113963, fixed in iOS 27.2.1, 26.7.3, and 18.7.12, is the same issue as worse_query.

Key facts
  • WQ Files is confirmed on the same three iOS versions Binance named.
  • The malicious app must be installed on the iPhone.
  • Binance advises a new wallet on a clean device if compromise is suspected.
  • CVE-2026-113963 was reported through App Intents, not App Group containers.
Security assessment · AI, from the articlePublic proof of concept

Impact: Malicious apps can read other apps' keys and credentials

ProductAffected
Apple iOS26.7.1, 27.0.1, and 27.2
What to do
  1. 1.Install the latest iOS and app updates.
  2. 2.Delete unnecessary and untrusted apps.
  3. 3.If compromise is suspected, move funds to a new wallet on a clean device and reset login sessions.
Analyze CVE-2026-113963 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-113963
ATT&CK
T1068 Exploitation for Privilege EscalationT1204.002 Malicious File
Tags
iosbinancesandbox-escapecryptocurrencyproof-of-conceptworse-query
Vendors
Apple
Products
iOS
Malware
WQ Files
Organizations
Binance

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-113963
Incorrect authorization lets apps read data on Apple devices
5.5—

From the original article

2 min read at bleepingcomputer.com

Binance is warning about a vulnerability in Apple's iOS 26. 7. 1, 27.

BleepingComputer

By Bill Toulas · bleepingcomputer.com

Read the full article at BleepingComputer

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.