iOS Sandbox Escape Threatens Crypto Wallet Keys

On Nov 10 2026, Binance warned that an iOS sandbox escape published on GitHub lets apps read files belonging to other apps on devices running iOS 26/27. This flaw could let attackers access seed phrases, private keys, and login credentials stored by crypto wallet apps. The researcher known as forcequit released the proof‑of‑concept called worse_query on Sunday. Apple’s latest updates for iOS 26 and 27, issued yesterday, do not list a fix for this vulnerability.¹

The escape exploits how CoreData’s SQLite engine handles file permissions within the sandbox. It is similar to CVE‑2018‑4963 which affected Android’s Binder IPC mechanism, allowing processes to read files outside their designated directories by exploiting lower‑level interprocess communication boundaries—a classic privilege escalation technique used in rootkit installation or credential theft on mobile platforms since around 2015 when sandboxing became common across macOS Gatekeeper and Windows UWP apps with distinct isolation mechanisms.

Because the issue lies deep in the operating system’s core libraries, a quick patch would risk breaking existing third‑party crypto wallets built on older SDK versions. A forced update might trigger denial‑of‑service scenarios if users are unaware of secure practices such as deploying hardware‑backed key management solutions rather than relying solely on software cryptographic primitives. NIST recommendations published early twenty‑two emphasize multi‑factor authentication plus regular auditing procedures to reduce overall attack surface exposure over time.

Binance’s alert underscores that even major exchanges cannot guarantee protection against OS‑level vulnerabilities. Users should keep iPhones updated, avoid installing non‑standard app installations or jailbreaking devices, and consider using hardware wallets for storing large amounts of cryptocurrency. Apple’s lack of an immediate fix indicates they may view this escape as low priority compared to other security issues, but it remains a significant risk for anyone running wallet apps on affected iPhone models.

The broader implication is that privacy‑sensitive data stored by popular mobile applications can be exposed through privilege escalation flaws that bypass normal sandbox boundaries. This highlights the need for continuous threat modeling and proactive defense strategies beyond code signing verification during runtime checks against known vulnerable libraries. Security teams must also adopt behavioral analytics and anomaly detection techniques—similar to those pioneered by FireEye in 2014—to identify anomalous activities indicative of compromise before exfiltration occurs.