A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s
Affects WhatsApp Desktop before 0.3.9309 when paired with WhatsApp for iPhone before 2.20.10. CVSS rates it high (8.2); no vendor severity is given.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 0.3.9309
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WhatsApp Desktop, when paired with the WhatsApp app on iPhone, is affected by this flaw. The issue can allow an attacker to run malicious scripts and read files on the user's local computer, but only if the user clicks a link preview in a specially crafted message.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Facebook WhatsApp Desktop
From unspecified · fixed in 0.3.9309
References 2
facebook.com
packetstormsecurity.com
Questions about CVE-2019-18426
What does this mean?
The flaw lets an attacker run cross-site scripting and read local files through WhatsApp Desktop. The facts do not describe the exact mechanism.Source: facebook.com
Am I affected, and how do I check?
WhatsApp Desktop versions before 0.3.9309 are listed as affected, but only when paired with WhatsApp for iPhone versions before 2.20.10. Check the WhatsApp Desktop version and the paired iPhone app version in each app's About screen.Source: facebook.com
What should I do about it?
Update WhatsApp Desktop to 0.3.9309 or later, and update WhatsApp for iPhone to 2.20.10 or later.Source: facebook.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-23, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data