An alarming vulnerability has surfaced for iPhones operating on iOS versions 26 and 27, potentially putting crypto wallet keys at risk. The issue, identified as an iOS sandbox escape, allows applications to access files from other apps on a device, raising concerns about the exposure of sensitive data such as seed phrases and private keys. Binance, the prominent cryptocurrency exchange, issued this warning, highlighting the absence of a confirmed fix in the recent iOS updates.
Details of the Vulnerability
The sandbox escape, named ‘worse_query’, was released by a researcher known as forcequit on GitHub. It appeared just before Apple’s latest updates for iOS 26 and 27 were published. Despite the potential risks, there have been no reports of attacks or thefts linked to this vulnerability. Binance has advised users to remain cautious by removing apps from unreliable sources and ensuring both iOS and individual app updates are current.
Users suspecting any breach are recommended to transfer their funds to a fresh wallet on a secure device and reset all active logins. The proof-of-concept code allows access to app data containers on iPhones and certain system folders on iOS 27 through the establishment of an App Group container. Although the code is intended for developers, others have built apps using it.
Apps Utilizing the Exploit
An application called WQ Files, developed by Christoph Kolbicz, employs the ‘worse_query’ exploit to access data from other apps without requiring a jailbreak. It can read, edit, and manage data across apps and is installed via sideloading tools like AltStore. These tools automatically create the necessary App Group when coupled with an Apple ID. As of now, it is unclear if App Store apps could leverage ‘worse_query’.
The versions mentioned in Binance’s alert align with those tested in WQ Files’ release notes. While the researcher’s notes suggest a wider compatibility range, only specific developers list version 27.2.1, which was part of this week’s iOS update. Notably, iOS 27.2.1 and 26.7.3, released yesterday, addressed iMessage and Bluetooth vulnerabilities but omitted any reference to ‘worse_query’.
Apple’s Response and Future Outlook
Apple traditionally refrains from disclosing security issues until comprehensive investigations and resolutions are made available. The researcher behind ‘worse_query’ expressed frustration over Apple’s delayed response, resulting in the early release of the exploit. Consequently, the exchange, researcher, and developers have not identified any specific wallet applications as being compromised.
As the situation unfolds, the importance of maintaining updated software and exercising caution with app installations remains paramount. Users and developers alike are urged to stay vigilant while awaiting further updates from Apple regarding this critical security matter.
