Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Binance warns iOS sandbox escape can expose crypto wallet keys

Original title: Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed

The Hacker News ()2 min read1
Read at thehackernews.com
Part of a story covered by 4 sourcesBinance warns public iOS sandbox escape can expose wallet filesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Public PoC worse_query reads other apps' data on iOS 26 and 27; Apple's latest notes list no fix and no thefts are reported.

Binance warned that an iOS sandbox escape published on GitHub can let an app read other apps' files on iPhones running iOS 26 and 27, putting seed phrases, private keys, and login credentials at risk. Researcher forcequit released the escape, worse_query, before Apple's iOS 26.7.3 and 27.2.1 updates, whose security notes do not mention it. Neither Binance nor the researcher reported attacks or thefts. Apps built on the PoC, including WQ Files, can reach other apps' data without a jailbreak when sideloaded.

Unconfirmed: No attacks are reported, no fix is confirmed, and no one has said whether an App Store app could use worse_query.

Key facts
  • forcequit says the PoC needs an App Group container and is not useful by itself.
  • WQ Files installs via AltStore or SideStore and can edit, delete, or clear other apps' data.
  • Only Erosion's developers list iOS 27.2.1, with a note that support is "pretty sure."
  • Yesterday's iOS updates fixed two iMessage flaws and several Bluetooth bugs, not this escape.
  • Binance did not name any wallet app as exposed.
Security assessment · AI, from the articlePublic proof of concept

Impact: Read other apps' files, including keys and credentials

ProductAffected
Apple iOSiOS 26 and 27
What to do
  1. 1.Delete apps installed from untrusted sources, including sideloaded or manually signed apps.
  2. 2.Update iOS and all installed apps.
  3. 3.If a breach is suspected, move funds to a new wallet on a clean device and reset login sessions.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
iossandbox-escapebinancecrypto-walletsmobile-securitysideloading
Vendors
Apple
Products
iOS
Malware
worse_query
Organizations
Binance

From the original article

2 min read at thehackernews.com

An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.

The Hacker News

thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.