Description (CNA)
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Facebook / WhatsApp for Android | affected 2.25.8.0 before 2.26.7.10 |
| Facebook / WhatsApp for iOS | affected 2.25.8.0 before 2.26.15.72 |
CWE
No CWE identifiers supplied.
References
- https://www.facebook.com/security/advisories/cve-2026-23866
- https://www.whatsapp.com/security/advisories/2026
ADP enrichment
No English description supplied.
No references supplied.