Binance has warned iPhone users about a vulnerability in Apple's iOS that it says could let malicious apps read files stored by other apps, putting crypto wallet seed phrases, private keys and login credentials at risk.

The flaw, dubbed "worse_query," affects iOS 26.7.1, 27.0.1 and 27.2, the exchange tweeted on Tuesday. "This is an iOS-level issue, not unique to Binance," it said.

Binance urged users to delete any apps installed from untrusted sources, such as sideloaded or manually signed app files, and to update iOS and all apps to the latest official versions. Anyone who suspects a breach should move their funds to a new wallet created on a clean device and reset all active login sessions, it said.

iPhone apps normally run inside a sandbox, which stops them from accessing other apps' private files. A researcher who goes by forcequitOS published worse_query on GitHub as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, describing it as a proof of concept for developers that "isn't useful by itself." Among the locations it can reach is the folder where iOS apps store their data, according to the repository, which calls it the "direct successor" to an earlier exploit, bad_query. There have been no confirmed reports of crypto being stolen using the flaw.



Apple's update

Apple released iOS 27.2.1 on Monday, a day after the proof of concept was published. Its security notes list fixes for nine vulnerabilities, including an authorization issue in App Intents through which "an app may be able to access sensitive user data," as well as several Bluetooth and iMessage flaws.

However, the notes do not mention worse_query or its researcher, and Apple has not publicly confirmed whether the update addresses the flaw Binance described. At least one security expert believes it does. 23pds, chief information security officer at blockchain security firm SlowMist, urged users to update to iOS 27.2.1, saying in a tweet that the update would block the worse_query sandbox escape, along with other threats.

It is not the first time attackers have targeted Apple devices. Earlier this year, Google warned of iOS malware that targeted crypto apps on unpatched devices, while in August, the Dutch national cyber agency said hackers were exploiting a flaw in Apple's macOS Screen Sharing feature to plant Monero miners on Macs.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。