A researcher published an iOS sandbox escape called worse_query on GitHub, and Binance is warning users. It lets an app read other apps’ files on iOS 26 and 27, including wallet seed phrases, keys and logins. Apple’s updates this week don’t list a fix.
How bad
The proof-of-concept can reach every app’s data container, plus some system folders on iOS 27. The app needs an App Group container to use it. Someone already built a file manager on it, WQ Files, which can read, edit and delete other apps’ data with no jailbreak, installed through sideloading tools like AltStore and SideStore. Nobody has reported attacks or thefts yet.
What to do
- Delete sideloaded or manually signed apps you don’t fully trust.
- Update iOS and your apps anyway, and watch for a fix.
- If you keep crypto on your phone and think you were exposed, move funds to a new wallet created on a clean device and reset your sessions.
God Bless, and Needs Garlic!
