Meta Patches WhatsApp Flaws Enabling Malicious URL Handling and Windows File Spoofing
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 5, 2026
Meta disclosed and patched two WhatsApp vulnerabilities affecting iOS, Android, and Windows, including CVE-2026-23866, which allowed attackers to abuse Instagram Reels integration and incomplete validation of AI-rich response messages to make victim devices process media from attacker-controlled URLs. The flaw could potentially trigger OS-level custom URL scheme handlers without user consent, creating opportunities for phishing, tracking, malware delivery, and other social-engineering attacks through seemingly legitimate WhatsApp content.
Meta also fixed CVE-2026-23863, a WhatsApp for Windows filename spoofing issue caused by embedded NUL bytes that could make executable files appear to be benign documents and require only a single user click to exploit. The company said both bugs were reported through its bug bounty program and that it had no evidence of active exploitation at disclosure, while urging users to update WhatsApp from official sources and advising organizations to verify Windows clients are patched and include messaging apps in enterprise attack-surface management.
