The app sandbox is the one promise every iPhone user takes for granted: your apps can't read each other's files. A researcher just published code that breaks it — and the world's biggest crypto exchange is telling its users to act like their wallets are exposed.
Binance warned iPhone users on Tuesday about a flaw called worse_query, a sandbox escape that lets a malicious app read files belonging to other apps on iOS 26 and 27. Seed phrases, private keys, and login credentials are all in the blast radius if a wallet or other app stores them locally in a readable form. Binance named iOS 26.7.1, 27.0.1, and 27.2 as affected; the researcher gives a wider range, iOS 26.0 through 26.7.2 and iOS 27 through 27.2. The exchange stressed this is an iOS-level problem, not a Binance one — and that it has found no confirmed cases of anyone's funds actually being stolen through it.
The timing is what makes this one uncomfortable. The researcher, who goes by forcequit, released the proof of concept on GitHub on Sunday, November 8 — a day before Apple shipped iOS 27.2.1 and iOS 26.7.3. Those updates fixed two iMessage flaws and several Bluetooth bugs, but their security notes don't mention worse_query or any sandbox issue, and no CVE has been assigned. One developer tracking the flaw has even listed iOS 27.2.1 as supported, writing that he is "pretty sure 27.2.1 is supported." In other words, updating your phone — the first thing every security warning tells you to do — may not close this hole. Apple, per its own policy, doesn't discuss security issues until it has investigated and a patch is available.
The escape itself is already more than a lab curiosity. To use it, an app sets up an App Group container, which then lets it reach every app's data container on the phone — and some system folders on iOS 27. Developers have already built working apps on it: WQ Files, a file manager from developer Christoph Kolbicz, can browse, edit, and delete other apps' data without a jailbreak or a kernel exploit. It installs through sideloading tools like AltStore and SideStore. Nobody involved has said whether an App Store app could pull the same trick, which is the distinction that matters most — and the one nobody can yet answer.
Binance's advice is blunt and practical: delete apps installed from untrusted sources, update iOS and all your apps anyway, and if you suspect a compromise, move funds to a fresh wallet created on a clean device and reset every active login session. The researcher, for his part, said he hadn't planned to release early — "Apple was stalling on responding to me," he wrote on X.
That last line is the real story here. A researcher felt ignored, published the escape, and within two days a crypto exchange with hundreds of millions of users was warning them about it — while Apple still hasn't said a word about whether its latest update fixes it. Until it does, the safest assumption for anyone with a wallet on their iPhone is the one Binance is already making: assume the sandbox has a hole in it.
— via The Hacker News