iOS Sandbox Escape Gives Crypto Seed Phrases a Bad Query 🍏🔐

Binance warned on Tuesday, November 10, 2026, that a vulnerability affecting iOS 26.7.1, 27.0.1 and 27.2 could allow malicious apps to read local files stored by other apps, exposing cryptocurrency wallet recovery phrases, private keys and login credentials across the broader mobile ecosystem. The exchange said the issue was “an iOS-level issue, not unique to Binance” and advised users to delete apps installed from untrusted sources, including sideloaded or manually signed app files, and update iOS and all apps to their latest official versions.

The flaw, named “worse_query,” was publicly disclosed by security researcher forcequitOS on Sunday, with credit given to another researcher who goes by 0xjohnny. Published on GitHub as a proof of concept for developers that “isn't useful by itself,” the sandbox escape reportedly affects iOS 26.0 through 26.7.2 and iOS 27.2. It can reach the folder where iOS apps store their data and is described as the “direct successor” to an earlier exploit called bad_query. Blockchain security firm SlowMist said a malicious app could read recovery phrases when wallets store them unencrypted on the device.

Apple released iOS 27.2.1 and iOS 26.7.3 on Monday, but the security notes did not mention worse_query, its researchers or a specific fix for the sandbox escape. Apple’s notes list fixes for nine vulnerabilities, including an App Intents authorization issue in which “an app may be able to access sensitive user data,” along with several Bluetooth and iMessage flaws. At least one security expert believes the update addresses the flaw: 23pds, chief information security officer at SlowMist, urged users to update to iOS 27.2.1, saying it would block the worse_query sandbox escape and other threats.

There have been no confirmed reports of cryptocurrency being stolen through worse_query. Users who suspect a breach were instructed by Binance to transfer funds to new wallets created on clean devices and reset all active login sessions. Cointelegraph said it had contacted Apple and Binance about the vulnerability but had not received a response by publication.

Google researchers have separately identified an iOS exploit chain called DarkSword that has been used in the wild to deliver malware targeting cryptocurrency apps on vulnerable iPhones. DarkSword leverages six vulnerabilities against devices running iOS versions 18.4 through 18.7, according to the research, while Apple devices have previously been targeted by malware campaigns focused on unpatched crypto applications.