CVE-2019-18426 WhatsApp Cross-Site Scripting
An attacker can execute scripts and read local files by tricking a WhatsApp Desktop user into clicking a malicious link preview.
- Exploited in the wild
- Since 23 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-18426?
CVE-2019-18426 is a high-severity cross-site scripting vulnerability in Facebook WhatsApp Desktop, published on 21 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Weakness: CWE-79
Which versions are affected by CVE-2019-18426?
It affects 1 product.
Products include Whatsapp Whatsapp.
How do I fix CVE-2019-18426?
No fix has been published for CVE-2019-18426 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 13 Jun 2022.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-18426 being exploited?
Yes. Attackers have exploited CVE-2019-18426 in the wild since at least 23 May 2022.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Facebook WhatsApp Desktop
- CVE-2019-3568 WhatsApp VOIP Stack Buffer Overflow
- CVE-2025-55177 Meta Platforms WhatsApp Incorrect Authorization
- CVE-2022-36934 Integer overflow in WhatsApp Business for Android
- CVE-2021-24042 Memory corruption in WhatsApp Business for Android
- CVE-2021-24041 Memory corruption in WhatsApp Business for Android
Sources
Also known as GHSA-x67c-8vp2-26mr.