Binance says iOS flaw worse_query could expose crypto wallet secrets
Binance says iOS flaw worse_query may let malicious apps read other apps’ files, including seed phrases; update iOS and remove untrusted apps.
- Published
- Fixed in
- Apple iOS 27.2.1, 26.7.3 and 18.7.12 released November 9 (whether they fix worse_query is not confirmed)
- Exploitation
- Not confirmed in the wild. A public proof-of-concept tool (WQ Files) was published, and no cryptocurrency losses have been confirmed, according to BleepingComputer.
Live scores
CVE-2026-113963- EPSS
- 0.001
low predicted chance of attack - VEDAS
- 0.050
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
What happened
According to BleepingComputer, Binance is warning about a vulnerability it calls “worse_query” in Apple’s iOS 26.7.1, 27.0.1 and 27.2. Binance says the flaw allows malicious apps to read local files from other apps, putting seed phrases, private keys and login credentials at risk. Binance also says the issue is at the iOS level and does not affect only the Binance app, per the same report.
BleepingComputer reports that no cryptocurrency losses have been confirmed, and that Binance urges users to install the update immediately as a precaution. This is Binance’s warning as relayed by one outlet. No Apple statement on worse_query is available in the source, and BleepingComputer says it has contacted Apple for comment.
BleepingComputer describes “worse_query” as a publicly disclosed iOS sandbox escape technique. It reports that a proof-of-concept exploit was published the day before its article, using a tool called WQ Files. According to BleepingComputer, WQ Files can browse, export, edit and delete other apps’ data without a jailbreak. It must be installed on the iPhone, so an attacker could distribute it as a sideloaded app outside the App Store. BleepingComputer says WQ Files has been confirmed to work on the same three iOS versions Binance named.
BleepingComputer also reports that Apple released iOS 27.2.1, 26.7.3 and 18.7.12 on November 9, addressing nine flaws. One of them, tracked as CVE-2026-113963, could allow an app to access sensitive user data. BleepingComputer says it is unclear whether this is the same issue Binance is warning about. It adds that the CVE was reported by László Várady, who found that the access occurred through App Intents, not App Group containers. The source does not link to an NVD entry for this CVE.
Not confirmed: whether Apple’s November 9 updates fix worse_query, any exploitation in the wild, and any user losses.
Am I affected?
Per BleepingComputer, the versions named by Binance are iOS 26.7.1, 27.0.1 and 27.2. The tool needs to be installed on the device. Possible exposure includes seed phrases, private keys and login credentials stored by other apps. If you run one of those versions and have unfamiliar or sideloaded apps, treat the warning as relevant to you.
Whether other iOS versions are affected is not confirmed in the source.
What to do now
- Update iOS to the latest available release. Apple’s November 9 releases are iOS 27.2.1, 26.7.3 and 18.7.12, according to BleepingComputer. Whether they close worse_query is not confirmed.
- Update your other apps to their latest versions, as Binance recommends.
- Delete unnecessary and untrusted apps, and avoid installing sideloaded apps from outside the App Store.
- If you suspect compromise, Binance advises moving funds to a new wallet created on a clean device and resetting all active login sessions.
- Watch for Apple’s reply to BleepingComputer’s request for comment, which may clarify whether the fix covers worse_query.