VulnerabilityPublished 5 May 2026

WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities

Source SecurityWeek

Mentioned vulnerabilities

Severity

Medium

Rated by Threat Radar

Data as of 6 May 2026, 02:39 UTC

What to do

AI-suggested

Both vulnerabilities have been patched by Meta in updates released earlier this year. Users should ensure they are running WhatsApp versions at or above 2.3000.1032164386.258709 on Windows, 2.26.15.72 on iOS, and 2.26.7.10 on Android. No additional mitigation is required as the issues are resolved in these official updates.

Description

The vulnerabilities were reported to Meta through its bug bounty program and were patched with updates released earlier this year. The post WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities appeared first on SecurityWeek .

Impact

Successful exploitation of CVE-2026-23863 could allow an attacker to trick a user into executing a malicious file disguised as a harmless attachment on WhatsApp for Windows. CVE-2026-23866 could allow an attacker to cause a victim's device to process media content from arbitrary URLs and invoke OS-level custom URL scheme handlers, potentially leading to redirection to phishing sites or launching other apps. However, there is no evidence these vulnerabilities have been exploited in the wild.

Summary

Two medium-impact vulnerabilities were disclosed and patched in WhatsApp. CVE-2026-23863 is a file spoofing vulnerability in WhatsApp for Windows prior to version 2.3000.1032164386.258709, where attackers could embed NUL bytes in attachment filenames to disguise executables as harmless files. CVE-2026-23866 affects WhatsApp for iOS (v2.25.8.0-v2.26.15.72) and Android (v2.25.8.0-v2.26.7.10), involving incomplete validation of AI rich response messages for Instagram Reels, allowing triggering of media processing from arbitrary URLs and OS-controlled custom URL scheme handlers. These flaws could enable attackers to execute malicious files or redirect users via custom URL schemes. Both were responsibly disclosed and patched by Meta, with no known exploitation in the wild.

References

securityweek.com/whatsapp-discloses-file-spoofing-arbitrary-url-scheme-vulnerabilities/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 5 May 2026, 09:06 UTC

References

Community reviews

Related threats