Medium · published August 29, 2025
CVSS calls it medium at 5.4. It is confirmed in active exploitation. It sits in the 91.8th percentile for exploit probability.
⚠️ A crafty combination of vulnerabilities could let an unrelated user send content straight to your device! 😱 Think of it like a clever trickster who gains access to your party and starts sending messages to your friends without an invitation — it’s sneaky and definitely not welcome! If exploited, this vulnerability allows a malicious user to trigger the processing of content from any URL on a targeted device. This could lead to unauthorized access to sensitive information or even control over app functionalities, changing the game for targeted users. Yikes!
Think of it like a clever trickster who gains access to your party and starts sending messages to your friends without an invitation — it’s sneaky and definitely not welcome! This vulnerability in WhatsApp for iOS and Mac involves incomplete authorization checks for linked device synchronization messages, allowing attackers to manipulate how the app processes incoming content from arbitrary URLs.
If exploited, this vulnerability allows a malicious user to trigger the processing of content from any URL on a targeted device. This could lead to unauthorized access to sensitive information or even control over app functionalities, changing the game for targeted users. Yikes! To mitigate this, update to WhatsApp for iOS v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, or WhatsApp for Mac v2.25.21.78 immediately. Additionally, ensure your Apple OS is patched for any related vulnerabilities. Stay vigilant! You've got this! With these updates, you'll be fortifying your defenses like a security champion! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| whatsapp/whatsapp | ≥ 2.22.25.2, < 2.25.21.73 | 2.25.21.73 |
| whatsapp/whatsapp | ≥ 2.22.25.2, < 2.25.21.78 | 2.25.21.78 |
| whatsapp/whatsapp_business | ≥ 2.22.25.2, < 2.25.21.78 | 2.25.21.78 |