Binance warned that the suspected sandbox escape could expose recovery phrases, private keys, and login credentials stored on iPhones
Binance advised iPhone users to remove applications from untrusted sources
Photo Credit: Unsplash/Sunny Hassan
iOS users on Binance have been advised by the exchange that there is a potential problem in the system known as “worse_query,” where malicious programs can access other apps' files. November 10 security alert revealed that iOS 26.7.1, 27.0.1, and 27.2 were among the vulnerable software. The vulnerability exposes recovery phrases, private keys, and login credentials saved on the device, while emphasising that the issue is associated with Apple's operating system and not just Binance.
This vulnerability is associated with the application sandbox that is used by Apple to protect the company's products from access to the files of other apps. This vulnerability was discovered in the worse_query research repository, where it was noted that the flaw enables an application to access directories that can be accessed only by other applications. The proof of concept applies to iOS 26 and iOS 27 versions.
This problem has been termed a sandbox escape because a program can have access beyond the permitted file access. The author of the repository terms worse_query as a developer's proof-of-concept code and says that it is not a jailbreak. From the information provided, there is no evidence that the vulnerability has been used to steal cryptocurrency.
Nevertheless, Binance stated that if such files containing personal information were available to other applications due to the security flaw, then malicious apps would be able to access them.
As per the warning from Binance, the threat affects “the whole ecosystem,” including cryptocurrency wallets as well as other applications that hold sensitive information of customers. Binance advised customers to uninstall apps that were downloaded from untrusted sources, especially manually signed or sideloaded IPA files. Moreover, it recommended updating iOS as well as applications to their latest versions.
For users who suspected their wallet credentials had been compromised, the suggestion was made that they create a new wallet on a fresh device, transfer their funds, and log out of all active sessions. In light of this alert, X user DUKE repeated the exchange's recommendation to uninstall any untrusted applications and create new wallet credentials.
Apple has issued a number of security patches for iOS versions included in the Binance warning. According to the company's security release history, iOS 27.2 was released on October 26, after which iOS 27.2.1 was launched on November 9. The new update fixes some vulnerabilities associated with user data and security.
However, neither Apple's advisories nor their CVE numbers make explicit references to worse_query, and there is no CVE number known for this sandbox escape. Therefore, one cannot determine if the latest update has fully solved the problem of access through that particular means.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.