WORLDTECHBinance warns iPhone users of iOS flaw that researchers say is unpatched
Crypto exchange Binance has cautioned iPhone users that a flaw in iOS could allow malicious apps to read sensitive files belonging to other apps. According to 9to5Mac, researchers say the vulnerability has not been patched.
Warning covers seed phrases and login data
In a post on X, Binance said a vulnerability it calls worse_query could let malicious apps read local files from other apps, placing seed phrases, private keys and login credentials at risk across the wider ecosystem. The company describes the problem as one that sits at the iOS level rather than being unique to Binance.
Binance says the flaw affects iOS 26.7.1, iOS 27.0.1 and iOS 27.2.
Researchers say no fix has arrived
A Community Note attached to the post notes that researchers classify the vulnerability as an unpatched zero-day. It adds that Apple's most recent security updates, including iOS 27.2.1, the current version at the time of writing, make no mention of a fix.
A researcher posting as @forcequitOS also observed that neither iOS 27.2.1 nor iOS 27.3 beta 1 addresses the vulnerability.
Binance advises immediate precautions
Besides updating devices, Binance advises iPhone crypto holders to delete any apps installed from untrusted sources, such as sideloaded or manually signed IPA files. It also recommends bringing iOS and all apps up to their latest official versions.
If users suspect a breach, Binance suggests moving funds to a new wallet created on a clean device and resetting all active login sessions.
Open questions
- Will Apple release a patch for the worse_query vulnerability?
- Has the flaw been exploited in attacks against users?