Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChigh

Binance warns public iOS sandbox escape can expose wallet files

4 sources · 4 articlesFirst reported Updated ()1
What's new

November 10: Later reports say WQ Files can edit, delete, and export data, can reach some iOS 27 system folders, and that CVE-2026-113963’s link to worse_query is unclear.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A public iOS sandbox-escape proof of concept can read other apps’ files; Apple has not confirmed a fix and no thefts are reported.

Binance warned on November 10 that worse_query, a public sandbox-escape proof of concept, can let a malicious app read other apps’ local files on iOS 26.7.1, 27.0.1, and 27.2, including seed phrases, private keys, and login details. Researcher forcequitOS published it before Apple’s November 9 releases of iOS 26.7.3 and 27.2.1; those notes do not confirm a fix, and Binance says the flaw is in iOS, not unique to Binance. The proof of concept needs an App Group container and is not a complete theft tool. Sideloaded WQ Files can view, edit, delete, and export other apps’ data without a jailbreak. Neither Binance nor the researcher has reported attacks or cryptocurrency losses.

Key facts
  • Binance named affected iOS 26.7.1, 27.0.1, and 27.2.
  • Researcher published a PoC for iOS 26.0–26.7.2 and iOS 27.2.
  • WQ Files is sideloaded and needs no jailbreak.
  • On iOS 27 the technique can reach some system folders.
  • BleepingComputer says CVE-2026-113963 may not match worse_query.
  • Binance advises removing untrusted apps and updating iOS.
Analyze CVE-2026-113963 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 9, 2026Apple released iOS 26.7.3 and 27.2.1 without confirming a fix. · Cyber Security News
  2. Nov 10, 2026Binance warned that worse_query can expose other apps’ files. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsSlowMist warning and researcher’s broader affected-version range.
  • The Hacker NewsWQ Files via AltStore or SideStore; updates fixed other bugs.
  • Security AffairsOn iOS 27 the technique can reach some system folders.
  • BleepingComputerNine fixes including CVE-2026-113963, possibly unrelated App Intents bug.
CVEs
CVE-2026-113963
Vendors
Apple
Products
iOSWQ Files
Malware
worse_queryWQ Files
Organizations
BinanceSlowMist

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Cyber Security NewsFirst report

    Binance warns iOS worse_query flaw may expose wallet keys

    A public proof of concept describes a sandbox escape; Apple’s November 9 updates are not confirmed as a fix.

  2. · 1d ago The Hacker News

    Binance warns iOS sandbox escape can expose crypto wallet keys

    Public PoC worse_query reads other apps' data on iOS 26 and 27; Apple's latest notes list no fix and no thefts are reported.

  3. · 1d ago Security Affairs

    Public iOS sandbox escape can read other apps' files

    Binance says worse_query hits iOS 26.7.1, 27.0.1 and 27.2; no attacks are reported and Apple has not confirmed a fix.

  4. · 1d ago BleepingComputer

    Binance warns iOS flaw can leak wallet secrets to other apps

    A public WQ Files proof of concept reads other apps' data on iOS 26.7.1, 27.0.1, and 27.2; no crypto losses are confirmed.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-113963
Incorrect authorization lets apps read data on Apple devices
5.5—