Binance warned iPhone users on November 10 about "worse_query," an iOS cross-app file-access flaw that its alert said could leave cryptocurrency recovery phrases, private keys, and login credentials exposed. The warning, posted on the exchange's official X account, arrived one day after Apple shipped iOS 27.2.1 and 26.7.3, a pair of security releases whose published advisories document the vulnerabilities they address but make no explicit mention of the reported technique.

The omission does not establish whether Apple's latest updates prevent the technique. Binance's alert identified iOS 26.7.1, 27.0.1, and 27.2 among the affected versions and named recovery phrases, private keys, and login credentials as potentially exposed data.

Coin Bureau, a cryptocurrency media outlet, highlighted the warning in a November 10 post on X:

JUST IN: Binance warns Apple users of an iOS flaw that lets malicious apps read seed phrases, private keys and login credentials. The warning names iOS 26.7.1, 27.0.1, and 27.2. Called "worse_query," it breaks the isolation that normally keeps one app from accessing another… pic.twitter.com/SaZ3Q5KZbd

— Coin Bureau (@coinbureau) November 10, 2026

Researchers Document a Cross-App Sandbox Escape

Researcher forcequitOS published worse_query on November 8, describing it in a public GitHub repository as an application sandbox escape. Apple's sandbox normally restricts applications from accessing another app's private storage, a boundary that underpins the separation between apps on the company's mobile operating system.

The repository lists accessible application, extension, and shared-container directories across iOS 26 and 27. The demonstration requires an App Group entitlement, a prerequisite often absent from generalized warnings. App Group entitlements are typically granted to clusters of apps that are meant to share data among themselves, and the researcher's documentation flags the requirement as central to the demonstrated technique.

Crucially, the researcher calls the work a developer proof of concept, not a jailbreak. The disclosure establishes a possible access path, not actual theft or universal access to wallet secrets. Whether exposure occurs depends partly on where applications store data and how they protect it. Encrypted storage and separately protected keys are not equivalent to readable recovery phrases.

Unlike a phishing prompt, cross-app file access might occur without directly requesting a recovery phrase. However, accessing a file does not automatically decrypt properly protected data.

Apple Updates Leave Specific Fix Unclear

Apple released iOS 27.2.1 and 26.7.3 on November 9, after the reported disclosure. Its security notes for the releases (advisory one, advisory two) address several issues, including unauthorized data access through App Intents in iOS 27.2.1. Neither advisory identifies worse_query or names forcequitOS, and no confirmed public CVE mapping connects the App Intents fix to the demonstrated sandbox escape. CVE identifiers are the public catalogue entries through which disclosed software vulnerabilities are documented and matched to specific vendor fixes.

Because the advisories enumerate their fixes without referencing the proof of concept, iPhone users cannot tell from Apple's documentation alone whether the updates neutralize worse_query. Updating remains prudent regardless, but describing the flaw as fixed would go beyond the available evidence. The clearest resolution would be a subsequent Apple advisory that explicitly names worse_query or forcequitOS, or a public CVE entry tying the App Intents fix to the sandbox escape the repository documents; until such documentation appears, the researcher's GitHub repository and Binance's alert remain the publicly documented references for the technique.

Wallet Storage and User Precautions Draw Attention

Binance advised users to remove untrusted applications, particularly manually signed or sideloaded IPA files, and to update iOS and installed applications only through official channels. For cryptocurrency holders, recovery phrases and private keys are among the most sensitive secrets a mobile device can hold, since possession of those strings generally equates to control of the associated funds.

Users who suspect exposure should generate a fresh wallet on a clean device and transfer assets to it. They should also reset affected login sessions, since reinstalling an application cannot revoke credentials that have already been copied.

These measures address potential credential leakage, not confirmed losses attributed to this particular flaw. CoinCentral previously covered separate hardware vulnerabilities affecting older iPhones; those involve physical-access attacks, whereas worse_query concerns application file isolation.

Source: CoinCentral