Crypto exchange Binance issued a security alert on November 10, 2026, warning iPhone users about an operating system sandbox flaw. The vulnerability allows unverified programs to read isolated application data containers.
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.…
— Binance (@binance) November 10, 2026
Identified by researchers as worse_query, the defect bypasses traditional sandbox boundaries on iOS devices. Through an official X post, Binance confirmed that cryptographic private keys, recovery phrases, and credentials face unauthorized extraction.
Exploitation requires users to install third-party IPA files outside the official App Store environment. When opened, the payload reads local application sandboxes across system directories.
🚨 SlowMist TI Alert: iOS sandbox escape 0day PoC “worse_query” disclosed 🚨
A public PoC for a sandbox escape 0day, worse_query, targets iOS 26.0–26.7.2 and iOS 27.2. It is the successor to bad_query. 📱
⚠️ This is a container sandbox escape, not a jailbreak. It breaks the… https://t.co/zwnUpdktYS
— SlowMist (@SlowMist_Team) November 10, 2026
Blockchain security researchers assessed the exposure shortly after the exchange disclosed the flaw. Technical commentary shared by the SlowMist cybersecurity team clarified that the exploit represents a container escape rather than a full operating jailbreak.
The issue exposes mobile wallets that maintain unencrypted mnemonic strings or cached keystores in local storage. The vulnerability cannot automatically siphon assets without malicious application code running on the targeted smartphone.
Mobile defense remains critical following persistent infrastructure compromises across the industry. Historically, the Binance infrastructure breach demonstrated how state-backed actors target vulnerabilities across cryptocurrency pipelines.
Binance advised iPhone owners to immediately delete apps downloaded from unverified sources and update their device software. Users suspecting compromised credentials should transfer assets to newly generated wallets on secure hardware.
Security auditors await an official Apple patch note confirming whether forthcoming updates completely resolve the underlying container escape.
