The vulnerability, known as “worse_query”, reportedly affects certain versions of iOS, including 26.7.1, 27.0.1 and 27.2, according to Binance's warning issued on November 10.
The exchange stressed that the issue is related to Apple's operating system and is not limited to the Binance application.
According to cybersecurity publication BleepingComputer, the flaw could allow malicious applications to bypass security restrictions designed to prevent apps from accessing one another's private data. This type of attack is known as a “sandbox escape”.
If exploited, the vulnerability could expose sensitive information stored locally by cryptocurrency wallets and other applications.
Security researcher forcequitOS has published a proof-of-concept tool called “worse_query” on GitHub to demonstrate the reported vulnerability.
The tool reportedly allows access to files belonging to other applications, including browsing, exporting, modifying and deleting them, without requiring the iPhone to be jailbroken.
However, an attacker would first need to get a malicious application installed on the target device. This could potentially happen through untrusted sources or software distributed outside Apple's official App Store.
Has Apple Fixed the Vulnerability?
Apple released security updates on November 9, including iOS 27.2.1 and other updates addressing multiple vulnerabilities.
One of the patched issues, identified as CVE-2026-113963, could allow an application to access sensitive user information.
However, Apple's published security notes do not explicitly identify the worse_query vulnerability, leaving it unclear whether the latest updates address the specific issue highlighted by Binance.
BleepingComputer reported that it had contacted Apple for clarification.
What Should iPhone Users Do?
Binance has advised users to update their iPhones and installed applications to the latest available versions, remove unnecessary or untrusted apps, and avoid installing software from unofficial sources.
The exchange also recommended that users who suspect their cryptocurrency wallets have been compromised transfer their assets to a newly created wallet using a clean device.
It further advised resetting active login sessions to prevent potential unauthorised access.
Read More; An engineer’s laptop and $6.3 billion stolen; Is Binance that easy to hack?
Creating a new wallet is particularly important if a recovery phrase may have been exposed, as simply importing the same phrase into another application would not secure the compromised credentials.
No confirmed cryptocurrency thefts have so far been linked to the reported vulnerability.
Apple has also not publicly confirmed whether its latest security updates specifically address worse_query, leaving the full scope of the reported issue unclear.
