iPhone Flaw "worse_query": Why Wallet Apps on iOS 26 and 27 Could Be at Risk
On iPhones, every app normally lives in its own sealed container and cannot see what other apps store. A newly published flaw called worse_query breaks that separation. Binance warned on 10 November that it could expose seed phrases, private keys and login credentials of wallet apps. "This is an iOS-level issue, not unique to Binance," the exchange wrote.
What happened
A researcher known as forcequitOS published worse_query on GitHub on 8 November. It is a so-called sandbox escape: an app that uses it can read the data folders of other apps, and on iOS 27 some system folders as well. Binance names iOS 26.7.1, 27.0.1 and 27.2 as affected; according to the researcher's own notes, the range is wider and includes iOS 26.0 to 26.7.2. Security firm SlowMist stresses that it is not a full jailbreak, but it does break the isolation between apps.
How serious is it?
So far, neither Binance nor the researcher has reported any attacks or stolen funds, and no specific wallet app has been named as exposed. How much an attacker could actually read depends on how each wallet stores its secrets. To use the technique, an app needs a special setup that sideloading tools create automatically. Whether an app from the official App Store could do the same is still unclear.
Apple released iOS 27.2.1 and iOS 26.7.3 on 9 November. The official security notes do not mention worse_query. SlowMist's security chief says iOS 27.2.1 stops the technique; Apple has not confirmed this.
What you should do now
- Update: install the latest iOS version and update all apps, especially wallet apps.
- Remove untrusted apps: delete apps you installed outside the App Store, for example via AltStore, SideStore or manually signed IPA files.
- Keep the phone a small wallet: only hold spending money in apps on your phone. Larger amounts belong on a hardware wallet, where the private keys never touch the phone.
- Never store your seed phrase on the phone: no screenshots, no notes, no photos in the camera roll.
- If you suspect a breach: create a new wallet on a clean device, move your funds there and log out of all active sessions.
Why it matters
Many people treat their phone as a safe. This case shows that even a well-protected operating system can have gaps, and that keys stored on a device that also runs dozens of other apps carry extra risk. The same rule we gave in our article on wrench attacks applies here: the phone is for small change, not for savings.
Sources
