CVE-2019-18426: WhatsApp Cross-Site Scripting Vulnerability
First published: Tue Jan 21 2020(Updated: )
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Credit: cve-assign@fb.com cve-assign@fb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Whatsapp Whatsapp | <2.20.10 | |
| Meta Platforms WhatsApp | <0.3.9309 | |
| Meta Platforms WhatsApp | ||
| All of | ||
| Whatsapp Whatsapp | <2.20.10 | |
| Whatsapp Whatsapp For Desktop | <0.3.9309 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-18426?
CVE-2019-18426 is a cross-site scripting vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10.
How can the vulnerability be exploited?
Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
Who is affected by CVE-2019-18426?
WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 are affected by this vulnerability.
What is the severity of CVE-2019-18426?
The severity of CVE-2019-18426 is high with a CVSS score of 8.2.
How do I fix CVE-2019-18426?
To fix CVE-2019-18426, update WhatsApp Desktop to version 0.3.9309 and WhatsApp for iPhone to version 2.20.10 or later.
- collector/nvd-index
- agent/type
- agent/description
- agent/severity
- agent/weakness
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/author
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- vendor/whatsapp
- canonical/whatsapp whatsapp
- canonical/meta platforms whatsapp
- vendor/meta platforms
- canonical/whatsapp whatsapp for desktop