The report

On November 10, 2026, Binance posted a warning about worse_query, an iOS flaw that lets a malicious app read local files belonging to other apps. Binance lists iOS 26.7.1, 27.0.1 and 27.2 as affected and calls it "an iOS-level issue, not unique to Binance."

The technique is public. A researcher who goes by forcequitOS published a proof of concept on GitHub; Decrypt reports the repository describes it as a sandbox escape for iOS 26.0 through 26.7.2 and iOS 27.2, and as the successor to an earlier exploit, bad_query. BleepingComputer covers a tool built on it, WQ Files, that can browse, export, edit and delete other apps' data without a jailbreak. The attacker's app has to be installed on the device, so sideloaded apps are the realistic delivery route.

Apple shipped iOS 27.2.1 and 26.7.3 on November 9 with nine security fixes, including one for an App Intents issue that could expose sensitive user data. Apple's notes don't name worse_query, and none of the coverage confirms the two are the same bug. No crypto theft has been confirmed.

What the coverage says is exposed

The reports describe reading files in other apps' storage. None of them says anything about Keychain items, so I'm not going to claim the Keychain is safe or unsafe here. What is clear is that anything your app writes to a file is in scope.

A checklist for your own app

If your app holds a mnemonic, a private key, an API secret or a long-lived session token:

  1. Search the container for secrets on disk. Look at Documents/, Library/Application Support/, Library/Caches/, tmp/, any App Group container, UserDefaults plists, Core Data or SQLite stores, and crash or debug logs. A seed phrase in a JSON backup file or a logged request body counts.
  2. Keep secrets in the Keychain with the narrowest accessibility class the feature allows, and avoid classes that sync or survive a device migration unless you need that.
  3. If you must keep something in a file, encrypt it with a key that lives in the Keychain (or the Secure Enclave), so a copied file is useless on its own.
  4. Treat App Group containers as shared space. Anything you put there for an extension or widget should be data you'd accept being read.
  5. Make server sessions revocable, and give users a "sign out everywhere" action. That is the recovery step Binance tells people to take.
  6. For wallets: make "create a new wallet and move funds" a short, well-tested path. If a user's seed may have leaked, a new seed and an on-chain transfer is the only real fix, and that transfer is irreversible, so show the destination address and network clearly before signing.

Telling your users

Binance's user advice is a good template: update iOS and all apps, delete apps from untrusted sources (sideloaded or manually signed), and if compromise is suspected, move funds to a new wallet created on a clean device and reset all sessions.

Sources: Binance on X, BleepingComputer and Decrypt (November 10, 2026); 24/7 Wall St. (November 10, 2026).