Binance has issued an alert to iPhone users concerning a significant vulnerability in certain iOS versions, which may allow malicious applications to access sensitive data from other apps. The affected versions, identified as iOS 26.7.1, 27.0.1, and 27.2, are at risk of exposing critical information such as seed phrases and private keys.
Understanding the Threat
This vulnerability, known as worse_query, affects the core operating system rather than any specific application like Binance. It compromises the isolation that typically protects each app’s private files. Should an attacker exploit this flaw, they could potentially gain access to sensitive data stored by crypto wallets and other applications.
The issue originates from a sandbox escape, as demonstrated by researcher forcequitOS. The sandbox serves as a restricted environment that limits an app’s access to files from other apps. The research indicates that the exposure includes access to application data folders and shared App Group folders.
Security Implications for Crypto Users
Although the worse_query flaw does not directly facilitate cryptocurrency theft, it raises concerns about data protection. While Binance emphasizes that not all file access leads to immediate financial loss, the vulnerability’s presence is enough to warrant caution. SlowMist security chief 23pds has highlighted the risk of untrusted IPA packages exploiting this flaw to access wallet recovery phrases and other sensitive data.
Despite previous fixes for similar iOS sandbox issues, there is no confirmation that worse_query has been addressed. This uncertainty underscores the need for users to remain vigilant and proactive in safeguarding their crypto assets.
Recommended Precautionary Measures
Binance advises users to uninstall apps from untrusted sources, including those sideloaded or manually signed. Keeping iOS and all installed applications updated is also crucial. In cases of suspected breaches, users should consider transferring their funds to a new wallet created on a secure device and resetting active login sessions.
Apple has released updates iOS 27.2.1 and 26.7.3 as of November 9, yet these updates do not explicitly confirm a fix for the worse_query flaw. Therefore, users are encouraged to apply updates promptly but remain cautious regarding previously exposed data.
Staying informed and taking preventive measures are key to protecting personal and financial information against evolving cybersecurity threats.
