What happened
An iOS sandbox escape called <code>worse_query</code> was published on GitHub by a researcher using the name forcequit. The reported flaw allows an app to read files belonging to other apps on affected iPhones. Binance warned that malicious apps could thereby expose seed phrases, private keys and login credentials. Exploitation has been confirmed in the wild, and the flaw was exploited before it became publicly known. No CVSS score has been published, so no severity level is stated here. The available facts do not state whether a fix exists. Apple's vendor advisory should be checked for fixed versions.
Who is affected
The vulnerable component is Apple iOS. Vendor-published affected versions are iOS 26 and iOS 27. The reported impact concerns files belonging to other apps on iPhones running those versions, including files that may contain cryptocurrency wallet seed phrases or private keys and login credentials. The reported attack condition is the presence of a malicious app capable of using the sandbox escape to access other apps' files. Further details about exploitation or the affected devices are not available in the supplied information.
Recommended actions
- Check Apple's vendor advisory for fixed versions, as the available information does not state whether a fix exists.
- Restrict app installation to apps that have been assessed as trustworthy, reducing the opportunity for a malicious app to use the reported file-access path.
- Review installed apps on affected iOS deployments and remove apps identified as malicious or untrusted, where feasible.
