Binance says it has found a flaw in several versions of iOS that would let a malicious app already installed on an iPhone bypass the per-app sandbox and read the private files of other apps.
The claimed exposure includes passwords, personal documents and crypto wallet recovery phrases or private keys. Binance calls the flaw WORS_QUERY.
What is claimed, and by whom
Binance says the affected versions are iOS 26.7.1, 27.0.1 and 27.2. An independent researcher on GitHub suggests the range may be wider — iOS 26.0 through 26.7.2.
Apple released iOS 26.7.3 and iOS 27.2.1 on Monday, with updates for older iPhones too. Apple's security notes list several fixes, but it has not said whether WORS_QUERY is among them.
Why this one needs more caution than most
We are reporting this because the claim is serious and widely circulated, not because it is established. The gaps are worth naming plainly.
There is no CVE number. Apple has not confirmed the flaw or the fix. The named source is a cryptocurrency exchange rather than a security vendor or a national agency, and the underlying report traces to the Daily Mail. The affected version range is already disputed between Binance and an independent researcher — which means at least one of them is wrong about the scope.
None of that makes the claim false. Sandbox escapes are real, they are among the most valuable iOS bugs there are, and a finder with a commercial interest in wallet security is a plausible discoverer. But the usual confirmations are missing, and a reader deciding what to do should know that.
What Binance itself says about exploitation
A Binance spokesperson told CryptoDaily the company found no evidence of an attacker using the flaw to access wallets or steal funds.
Worth noting: the organisation raising the alarm is also saying it has seen no harm from it.
What to actually do
The sensible steps are the same whether or not this specific claim holds up.
Update iOS. Settings → General → Software Update. Apple's Monday releases contain confirmed fixes regardless of whether WORS_QUERY is among them, so updating is worth doing on that basis alone.
Remove apps installed from outside the App Store, which is Binance's own recommendation. This matters because the flaw as described requires a malicious app to already be on the phone — a sandbox escape is not a remote attack. If everything on your device came from the App Store and you recognise all of it, the described risk largely does not reach you.
If you hold crypto on the phone, the recovery phrase should not be stored on the same device as the wallet app, flaw or no flaw. That is ordinary practice, and this claim is a reminder rather than a new reason.
Why Apple’s silence is not evidence either way
It would be easy to read Apple saying nothing as a denial. It is not. Apple routinely ships fixes before acknowledging a flaw, and routinely credits a finder weeks later once a patch has reached enough devices — because naming a live bug before users have updated tells attackers exactly where to look.
So "Apple has not confirmed it" means the claim is unverified, not that it is wrong. The confirmation, if it comes, usually arrives in a revised security note some days after the release. That is the document to watch, and it is the one that would settle whether WORS_QUERY was real and whether Monday's update fixed it.
