Meta Patches WhatsApp Flaws Enabling Malicious URL Handling and Windows File Spoofing
Meta disclosed and patched two WhatsApp vulnerabilities affecting iOS, Android, and Windows, including CVE-2026-23866, which allowed attackers to abuse Instagram Reels integration and incomplete validation of AI-rich response messages to make victim devices process media from attacker-controlled URLs. The flaw could potentially trigger OS-level custom URL scheme handlers without user consent, creating opportunities for phishing, tracking, malware delivery, and other social-engineering attacks through seemingly legitimate WhatsApp content.
Meta also fixed CVE-2026-23863, a WhatsApp for Windows filename spoofing issue caused by embedded NUL bytes that could make executable files appear to be benign documents and require only a single user click to exploit. The company said both bugs were reported through its bug bounty program and that it had no evidence of active exploitation at disclosure, while urging users to update WhatsApp from official sources and advising organizations to verify Windows clients are patched and include messaging apps in enterprise attack-surface management.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Meta urges users and enterprises to update affected WhatsApp versions
Following disclosure of the patched flaws, Meta advised users to update WhatsApp through official channels and recommended that organizations enforce app update policies and verify Windows clients are running fixed versions. The guidance highlighted risks including phishing, malware delivery, tracking, and social engineering if systems remain unpatched.
Meta patches two WhatsApp vulnerabilities disclosed via bug bounty
Meta disclosed and patched CVE-2026-23866, affecting WhatsApp on iOS and Android via Instagram Reels rich response handling, and CVE-2026-23863, affecting WhatsApp for Windows through filename spoofing with embedded NUL bytes. Meta said both flaws were reported through its Bug Bounty Program and that it had found no evidence of active exploitation.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta Patches Two WhatsApp Flaws Affecting Windows, Android, and iOS
Meta disclosed and fixed two medium-severity WhatsApp vulnerabilities reported through its bug bounty program, saying it found **no evidence of in-the-wild exploitation**. The first flaw, `CVE-2026-23863`, affected **WhatsApp for Windows** and could let a specially crafted attachment use hidden NUL bytes in a filename to appear as a harmless file such as a PDF while executing as a different file type when opened. The second flaw, `CVE-2026-23866`, affected **WhatsApp on Android and iOS** and stemmed from incomplete validation tied to Instagram Reels sharing and AI-driven message response handling, potentially causing the app to process media from an arbitrary URL or invoke OS-level custom URL scheme handlers. Meta said both issues were patched in April via updates to WhatsApp and advised users to install the latest app and device updates.
Jun 29, 2026
WhatsApp Vulnerabilities and Malware Targeting User Privacy and Security
A recently discovered vulnerability in WhatsApp allowed researchers to enumerate up to 3.5 billion active accounts by exploiting the app's contact syncing feature. This flaw, responsibly disclosed by researchers at the University of Vienna and subsequently patched by Meta, could have enabled malicious actors to build massive databases of phone numbers linked to WhatsApp, along with associated profile photos and "About" texts. While there is no evidence the vulnerability was exploited in the wild, the incident highlights the risks posed by convenience features and the critical importance of protecting phone numbers as sensitive personal data. In addition to this privacy risk, WhatsApp users are being targeted by a new Android malware that propagates itself through the platform. The malware automatically replies to incoming WhatsApp messages with malicious links, leveraging the trust users place in their contacts to spread further. This attack exploits the phenomenon of "context collapse," where users' social boundaries blur on messaging platforms, making them more susceptible to social engineering. These developments underscore the growing threat landscape facing WhatsApp users, combining both technical vulnerabilities and sophisticated social attacks.
Jun 29, 2026
WhatsApp Contact Discovery Flaw Exposes Billions of Phone Numbers
A group of Austrian researchers demonstrated that WhatsApp's contact discovery feature could be abused to enumerate and extract the phone numbers of 3.5 billion users globally. By automating the process of checking every possible phone number through WhatsApp’s browser-based app, the researchers were able to access not only phone numbers but also profile photos for 57% of users and profile text for 29%. This large-scale data exposure was possible because Meta, WhatsApp’s parent company, did not sufficiently limit the speed or volume of contact discovery requests, despite prior warnings about this vulnerability. In response to this and other security concerns, Meta has expanded its bug bounty initiatives, launching the WhatsApp Research Proxy tool to facilitate deeper research into WhatsApp’s network protocol and platform abuse. The company also reported adding new anti-scraping protections to WhatsApp after the enumeration technique was disclosed. Meta highlighted its ongoing investment in security, noting over $4 million in bug bounties paid out in the past year and the patching of several notable vulnerabilities, including CVE-2025-59489 affecting Quest devices.
Jun 29, 2026