All writing

worse_query iOS Vulnerability: What Crypto Users Must Do Now

Chinetpulse2 min read

  • iOS security
  • worse_query
  • crypto security
  • wallet safety
  • Binance
  • vulnerability
  • sandbox
  • cybersecurity

Overview

A vulnerability dubbed worse_query affects iOS 26.7.1, 27.0.1, and 27.2. It allows a malicious app to read local files belonging to other apps, which could put seed phrases, private keys, and login credentials at risk.

This is an iOS-level issue, not unique to Binance. Binance has warned that it affects the wider iOS ecosystem, not just its own application.

Immediate Action Required

• Delete apps from untrusted sources, such as sideloaded or manually signed IPAs. • Update iOS and all apps to the latest official versions. • If you suspect a breach, create a new wallet on a clean device, transfer your funds there, and reset all active login sessions.

Never install unauthorized packages, and keep your software up to date.

How worse_query Works

Every iOS app runs in its own sandbox, a restricted storage and execution environment. Your banking app, password manager, and crypto wallet each have separate private containers. Normally, one app cannot navigate into another app's container and read its files.

worse_query abuses Apple's container-management mechanisms to bypass this isolation. The proof of concept can access other apps' directories, including their documents, libraries, and temporary files.

Notably, it does this without a jailbreak or kernel exploit.

One important condition: the malicious app needs an App Group entitlement, which Apple normally uses to let apps from the same developer share data.

Why Crypto Users Should Care

Some wallets and apps store sensitive data locally. Depending on how an app handles its data, that could include:

• Authentication tokens • Account information • Encrypted key material • Other sensitive records

If a malicious app can read those files, it may expose information the operating system was supposed to keep private.

That does not mean every wallet's seed phrase or private key is automatically accessible. It depends on where and how each app stores its secrets.

The Researcher's Position

The researcher describes worse_query as a proof of concept, not a jailbreak. It is not a full device compromise, but it is serious enough to act on.

What To Do Now

1. Avoid installing apps from untrusted sources, especially manually signed or sideloaded apps. 2. Keep checking for official Apple security updates and install them promptly. 3. If you believe wallet credentials have been exposed, create a replacement wallet on a clean device and move your funds there.

Stay updated, stay cautious, and never install what you can't verify.