New iOS Exploit Could Let Malicious Apps Access Other Apps' Files

iPhone apps aren't supposed to snoop through one another's files. A newly disclosed iOS exploit suggests that protection may not always hold.

Cryptocurrency exchange Binance has warned about a vulnerability affecting certain iOS versions that could allow a malicious application to access files belonging to another app, potentially exposing sensitive information stored on the device.

In a Nov. 10 warning, Binance highlighted the risk to cryptocurrency users, whose wallets and exchange apps may contain valuable information. The vulnerability also raises broader concerns about how iOS protects data between applications, although there is no confirmed evidence of malicious exploitation.

The vulnerability at the heart of Binance’s announcement

Binance says the vulnerability, dubbed worse_query, affects iOS 26.7.1, 27.0.1, and the new iOS 27.2, and could allow malicious applications to access files belonging to other apps. To understand why this is a problem, we first need to look at how Apple normally keeps applications separate.

An iOS application operates within what is known as a sandbox. Think of this as a private storage area where an application keeps its files and data, with restrictions that prevent other applications from freely accessing them. 

This means that even if a malicious app gets onto your iPhone, it shouldn't be able to simply open another application's storage and start reading its contents.

However, security researcher forcequitOS published a proof-of-concept (PoC) called worse_query on GitHub on Nov. 8, demonstrating how these restrictions could be bypassed without jailbreaking the iPhone or exploiting its kernel.

This is not just a proof-of-concept sitting on GitHub. A developer, Christoph Kolbicz, has tried the technique on an application called WQ Files. 

The demonstration shows how the technique could be implemented in an application, rather than remaining a theoretical vulnerability. However, a working proof of concept does not establish that attackers have exploited the flaw against users in the wild.

Crypto users at higher risk

Binance's alarm focuses on the specific risk this vulnerability could pose to its already strained users. 

Crypto exchanges like Binance store some sensitive user information locally on their apps, within the protected storage areas iOS assigns to them. If a malicious application can bypass those protections and read the stored data, it could obtain information that an attacker may use to access a victim's account and potentially their funds.

The exchange specifically identifies seed phrases, private keys, and login credentials as examples of the information that could be exposed.

However, the actual exposure depends on what an application stores locally and how that information is protected. Access to an app's files does not necessarily mean an attacker can retrieve credentials secured through the iOS Keychain or other encryption mechanisms.

BleepingComputer reports that there is currently no evidence of attackers exploiting the vulnerability against cryptocurrency holders.

The potential impact also extends beyond cryptocurrency applications. Banking and other financial apps may store sensitive information locally, although the risk depends on their storage practices and security controls. The disclosed technique alone does not establish that attackers can access banking credentials or bypass authentication protections.

Has Apple fixed the iOS vulnerability?

A day before the Binance X post, Apple released a security update for nine vulnerabilities. BleepingComputer says that one of the flaws is tracked as CVE-2026-113963 and could allow an application to access sensitive user data. 

This sounds similar to the sandbox escape Binance warned about, particularly because both issues involve applications gaining access to data they shouldn't ordinarily be able to reach.

However, Apple hasn't explicitly confirmed whether that fix also addresses worse_query or the underlying issue Binance reported. 

The similarity between their descriptions is worth noting, but it isn't enough to establish that they are the same vulnerability. For now, users are left without a clear confirmation of whether Apple's latest security updates have closed the loophole demonstrated by the exploit.

What’s the way out for iOS users?

Given Binance's public warning and Apple's vague response, users shouldn't assume they are safe, even if they don't use Binance or any cryptocurrency app.

Installing the latest security updates remains important, but users should also review the applications installed on their devices, particularly those obtained from unfamiliar sources.

Anyone who suspects their cryptocurrency wallet's recovery phrase or private keys have been exposed should move their assets to a newly created wallet using a trusted device. Updating iOS alone cannot protect funds associated with an already compromised recovery phrase.

• Remove untrusted apps: Delete unnecessary applications, particularly those installed through unfamiliar third-party sources.
• Update iOS: Install the latest security updates available for your device, even though Apple hasn't explicitly confirmed a fix for worse_query.
• Update your apps: Keep banking, cryptocurrency, and other apps that handle sensitive information up to date.
• Monitor account activity: Watch for unfamiliar transactions, login sessions, and other signs of unauthorized access.
• Move compromised funds: If your wallet secrets may have been exposed, create a new wallet on a trusted device and transfer your funds. An iOS update alone cannot invalidate an exposed recovery phrase.

The worse_query is another reminder that device security goes beyond installing updates — the applications you install and the sensitive information you store on your device matter just as much. Even without confirmed attacks, these precautions are worth taking.

Until the scope and patch status are confirmed, users should be cautious about unfamiliar apps and keep their devices updated. 

In other news, Apple released iOS 27.2.1 and iPadOS 27.2.1, addressing security vulnerabilities affecting iMessage group chats, Bluetooth pairing, and AirPlay, while also rolling out updates for older devices to help users stay protected.