'Worst Query' Flaw Found in Several iOS Versions, Putting iPhone Private Files at Risk

Binance, the world's largest cryptocurrency exchange, says it has identified a security flaw in several versions of iOS, the iPhone operating system. The company fears a malicious app on an iPhone could use the flaw to read users' personal information and files held inside other apps.

According to Binance, the flaw, named 'Worst Query', exists in several versions of iOS 26 and iOS 27. Because of it, a malicious app installed on an iPhone could secretly read the private files of another app on the same phone.

Normally, each app on an iPhone is assigned its own protected space, so one app cannot access another app's private files or data. In technical language this arrangement is called 'sandboxing'. The Worst Query flaw could allow that protection to be bypassed and another app's data to be read.

The flaw is not itself malware. But if a malicious app is already installed on an iPhone, it could use the flaw to search out another app's files, copy them or change them.

The risk is higher for apps installed from outside Apple's App Store, because unlike App Store apps they do not pass through Apple's prescribed security checks. To address the problem, Binance has advised deleting from iPhones all apps downloaded from outside the App Store.

Binance fears hackers could use the flaw to take users' passwords, personal documents and even the secret codes of cryptocurrency wallets. Such wallets store the recovery phrase or private key needed to control digital currency. With that information, hackers could steal a user's cryptocurrency and could even take control of the wallet.

According to Binance, the flaw was identified in iOS 26.7.1, iOS 27.0.1 and iOS 27.2. An independent software researcher, however, claimed on the coding platform GitHub that the weakness may exist across a wider range of iOS 26 versions, with his published information suggesting it could be present from iOS 26.0 onward.

So far, however, no cyberattack or cryptocurrency theft using this flaw has been confirmed. A Binance spokesperson told the cryptocurrency news outlet CryptoDotNews that they had found no evidence of any attacker entering a cryptocurrency wallet or stealing money using Worst Query.

Apple, meanwhile, released a new security update for iPhones last Monday, including iOS 26.7.3 and iOS 27.2.1 along with updates for older iPhones. Apple's security note said several flaws had been fixed, including one through which a malicious app could have accessed a user's personal information. Apple did not say whether the Worst Query flaw was fixed in the new update.