cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Binance Warns iOS Flaw Could Expose Crypto Wallet Secrets

· Original article ↗

Summary

Binance warns that the iOS “worse_query” flaw could let apps access other apps’ files, including wallet secrets. A public tool demonstrates the technique; Apple released updates, but it is unclear whether they fix this issue.

Key points

  • Binance says “worse_query” affects iOS 26.7.1, 27.0.1, and 27.2 and could expose other apps’ files, including seed phrases, private keys, and login credentials.
  • A published proof of concept, WQ Files, reportedly uses the technique to browse, export, edit, or delete other apps’ data without a jailbreak.
  • The tool must be installed on an iPhone; the article says it could be distributed as a sideloaded app from an untrusted source.
  • Apple released iOS updates on November 9, but the article says it is unclear whether they address the flaw Binance described.
  • CVE-2026-113963 is among the vulnerabilities Apple fixed; the article notes it involves App Intents and may not be the same issue.
  • No cryptocurrency losses have been confirmed. Binance recommends updating, removing untrusted apps, and moving funds to a new wallet on a clean device if compromise is suspected.

Article Details

Vulnerability Types
  • iOS sandbox escape
  • Cross-app local file access
Affected Versions
  • iOS 26.7.1
  • iOS 27.0.1
  • iOS 27.2
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
unknown
Workarounds
  • Install the latest iOS and app updates.
  • Delete unnecessary and untrusted apps.
  • If compromise is suspected, transfer funds to a new wallet created on a clean device and reset all active login sessions.

MITRE ATT&CK

T1005 · Data from Local SystemThe WQ Files proof of concept can browse and export local data belonging to other apps.T1404The publicly disclosed worse_query technique is described as an iOS sandbox escape that lets an app cross security boundaries and access other apps' storage.

CVE

CVE-2026-113963Apple · iOS and iPadOS; Apple · visionOS; +1 moreOne of the fixed vulnerabilities, tracked as CVE-2026-113963, could allow an app to access sensitive user data.

People

László VáradyReportedly found the issue tracked as CVE-2026-113963; the article says the access occurred through App Intents, and it is unclear whether this is the same issue as worse_query.

Vendors

AppleBinance is warning about a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and

Products

iOSBinance warns of iOS flaw that could leak crypto wallet secrets

Tools

WQ FilesYesterday, a proof-of-concept exploit has been published that uses a tool called WQ Files to perform attacks relying on the technique.

Industries

Cryptocurrencyand 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials.

Related Articles