A vulnerability has been discovered in the Apple iOS operating system that allows malicious applications to read files from other programs. Because of this, cryptocurrency wallet keys, access recovery phrases, and user credentials may be at risk. The cryptocurrency exchange Binance warned about the problem.
Image Source: Apple
The vulnerability is called worse_query. In its warning, Binance listed The three operating system versions affected are iOS 26.7.1, 27.0.1 and 27.2. The exchange emphasized that the problem is related to the Apple platform itself and is not limited to its applications.
Under normal circumstances, iOS isolates each app in its own protected environment, preventing it from reading other people’s files. Worse_query makes it possible to bypass this limitation and gain access to the directories of other programs. If a crypto wallet stores sensitive data in files that are accessible in this way, it could end up in the hands of attackers.
A researcher under the pseudonym forcequitOS published demo code on November 8th. According to the project description, the issue affects a wider range of versions of iOS 26, as well as iOS 27.2. For the method to work, special configuration of the common App Group application container is required. The author emphasizes that the published code is intended for developers and is not in itself a full-fledged hacking tool.
On November 9, Apple released iOS 27.2.1 and iOS 26.7.3 updates that address several vulnerabilities. However, worse_query is not mentioned in official bulletins. How clarifies BleepingComputer, It is not yet known whether the problem is related to the patched vulnerability CVE-2026-113963.
Binance recommended removing applications installed from untrusted sources, including programs downloaded by bypassing the App Store. Users are also advised to update iOS and installed software. If you suspect your keys have been compromised, you should create a new wallet on a secure device, transfer funds there, and end any existing login sessions.
Other methods of stealing data from iPhone have already been used in real attacks. In particular, researchers previously described the DarkSword mechanism, which made it possible to obtain information from crypto wallets through malicious sites. Worse_query uses a different method of accessing data, and there are no confirmed cases of cryptocurrency theft using it.
If you notice an error, select it with the mouse and press CTRL+ENTER.
