CVE-2019-18426: WhatsApp Cross-Site Scripting Vulnerability
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Other sources
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-18426?
CVE-2019-18426 is a cross-site scripting vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10.
How can the vulnerability be exploited?
Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Who is affected by CVE-2019-18426?
WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 are affected by this vulnerability.
What is the severity of CVE-2019-18426?
The severity of CVE-2019-18426 is high with a CVSS score of 8.2.
How do I fix CVE-2019-18426?
To fix CVE-2019-18426, update WhatsApp Desktop to version 0.3.9309 and WhatsApp for iPhone to version 2.20.10 or later.