iOS Sandbox Escape 'worse_query' Threatens Crypto Wallets and App Secrets

As reported by BleepingComputer, Binance has issued a security alert regarding a vulnerability in Apple's iOS that permits malicious apps to read local files belonging to other applications — a sandbox escape with potentially devastating consequences for cryptocurrency users and anyone storing sensitive data on iOS devices.

The Technical Reality: Sandbox Escapes Are Severity-Tier Events

iOS's app sandbox is the architectural cornerstone of its security model. When that boundary fails, every assumption about data isolation collapses simultaneously. The worse_query technique, paired with the publicly available WQ Files tool, demonstrates a practical cross-application file access primitive that requires no jailbreak — meaning stock, fully-patched devices were vulnerable until Apple's November 9 release.

This is not merely a crypto problem. Binance is the canary in the coal mine because seed phrases are the highest-value, most portable secret an attacker can steal. But any app storing authentication tokens, encrypted databases, session cookies, or configuration files in its container was equally exposed. Banking apps, password managers, enterprise MDM-enrolled productivity suites, healthcare portals — all rely on the same sandbox guarantee that worse_query breaks.

Vulnerability Details

Why the Attack Surface Is Broader Than It Looks

The requirement that WQ Files be installed on the victim's device might seem like a meaningful constraint. It is not. Sideloaded app distribution has matured significantly, and threat actors routinely abuse enterprise provisioning profiles, compromised developer accounts, and social engineering to convince users to install apps outside the App Store. In regions where app sideloading is culturally normalized or where regulatory mandates have opened alternative app marketplaces, this attack path is trivially achievable.

The real danger isn't a single malicious app — it's the erosion of trust in the sandbox itself. Every iOS security architecture document, every MDM policy, every app developer's threat model assumes the sandbox holds. When it doesn't, the blast radius is the entire device.

Who Is Most at Risk

Shield53 Recommendations: Immediate Actions

For Individuals

• Patch immediately. Update to iOS 27.2.1, 26.7.3, or 18.7.12 depending on your device's supported branch. This is the single most effective mitigation.
• Audit sideloaded apps. Remove any apps installed via enterprise certificates, TestFlight, AltStore, or direct IPA installation that you do not fully trust.
• Relocate high-value secrets. Move seed phrases and private keys to hardware wallets. Never store them in any mobile app, note-taking tool, password manager screenshot, or cloud-synced document on a potentially exposed device.
• Reset sessions if exposed. If you suspect compromise, create a new wallet on a clean, patched device, transfer funds, and revoke all active sessions across exchanges and services.
• Review App Intents permissions. Check Settings > Privacy for any unexpected app integrations, particularly recently installed or sideloaded apps requesting broad data access.

For Enterprise Defenders and CISOs

• Push iOS updates via MDM immediately. Force-update all managed devices to the patched iOS versions. Block devices running vulnerable versions from accessing corporate resources.
• Restrict sideloading. Enforce MDM policies that prohibit app installation from untrusted sources. Disable enterprise certificate trust for non-approved publishers.
• Deploy mobile threat defense (MTD). Ensure your MTD solution can detect sideloaded apps and known-bad provisioning profiles. WQ Files and similar tools should be flagged on sight.
• Review app data-at-rest encryption. Developers should not rely solely on the sandbox for secrecy. Implement app-level encryption using Secure Enclave-backed keys so that even a sandbox escape does not yield plaintext secrets.
• Hunt for indicators. Look for devices with recently installed sideloaded apps, unexpected enterprise certificate trust changes, or apps requesting unusual App Intents registrations.

For iOS App Developers

• Stop storing secrets in plaintext files. Use the Keychain with access control lists, not NSUserDefaults or flat files, for any sensitive data.
• Implement data protection classes. Use NSFileProtectionComplete for sensitive files so they are encrypted with device passcode-derived keys, not just sandbox-isolated.
• Audit App Intents exposure. Review whether your app's App Intents extensions inadvertently expose data access paths that could be abused.

Broader Implications

The worse_query disclosure highlights a persistent tension in mobile security: as Apple expands inter-app communication features (App Intents, widgets, shortcuts, share sheets), the attack surface between sandbox boundaries grows. Each new integration point is a potential sandbox escape vector. CVE-2026-113963 being App Intents-related is not surprising — the feature was designed for convenience, and convenience features are where sandbox boundaries get blurry.

For the cryptocurrency ecosystem specifically, this is yet another reminder that mobile devices are not suitable long-term storage for high-value keys. The industry's continued reliance on mobile wallet apps for everyday use is acceptable, but seed phrase storage on mobile — in any form — is a systemic risk that this vulnerability makes painfully clear.

Defenders should also note the speed of public weaponization. A proof-of-concept tool was published within days of the vulnerability becoming known. The window between disclosure and patch application is now measured in hours, not weeks. Mobile patch management must be treated with the same urgency as server infrastructure.