Cryptocurrency exchange Binance has published a security advisory warning users about an iOS sandbox escape vulnerability that could potentially expose crypto wallet keys. The warning follows the release of a proof-of-concept tool on GitHub by a researcher named forcequit. Although updates have been issued by Apple, no fix for this specific sandbox escape has been officially confirmed as of yet.
The vulnerability involves a sandbox escape mechanism known as worse_query, which allows malicious applications to bypass standard operating system restrictions. Specifically, the flaw enables a malicious app to access other applications’ data containers and system folders on affected devices without requiring a jailbreak. This capability creates significant security concerns regarding the confidentiality of locally stored sensitive information, including private keys.
According to security findings, the issue affects iPhones running iOS 26 and iOS 27. Building upon the worse_query tool, developer Christoph Kolbicz created a file manager utility called WQ Files, which can be installed using sideloading tools such as AltStore and SideStore. This demonstration highlighted how unauthorized applications could theoretically interact with restricted directories on the mobile platform.
While the proof-of-concept and utility have drawn considerable attention within the security community, neither Binance nor the original researcher have reported active attacks or thefts exploiting this vulnerability. Apple has recently released operating system updates, specifically iOS 27.2.1 and iOS 26.7.3, but these releases address separate iMessage and Bluetooth bugs rather than confirming a patch for the worse_query flaw.
The potential impact centers on users who sideload applications from untrusted sources, as malicious code leveraging the sandbox escape could read private data containers. Because cryptocurrency wallet security relies heavily on secure local storage and app isolation, any breach of the iOS sandbox environment poses a direct risk to digital asset management and user funds.
To mitigate potential risks, Binance recommends deleting any applications installed from untrusted sources, such as manually signed or sideloaded apps. Users should also ensure that their iOS software and all installed applications are updated to the latest available versions. If a security breach is suspected, individuals are advised to move their funds to a new wallet created on a clean device and reset all active login sessions.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
