8.2
High
CVE-2019-18426 WhatsApp Cross-Site Scripting Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-79
Description
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WhatsApp Desktop 0.3 | earliest → 0.3.9309 | 0.3.9309 |
Other CVEs of WhatsApp Desktop
The 5 CVEs of WhatsApp Desktop →
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23,…
9.8
Critical
CVE-2020-1889
A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in…
Not rated
CVE-2019-11928
An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon…
Not rated
CVE-2019-3571
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send…
Not rated