Actively exploited · Published Jan 21, 2020 · Assigned by facebook

CVE-2019-18426

High 8.2 Exploited

In plain English

A high-severity cross-site scripting in WhatsApp Desktop from Facebook. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2022). The chance it is exploited in the next 30 days is estimated at 67.9% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)67.9%top 0.7% of all CVEs

Exploited in the wildYesCISA KEV since May 23, 2022

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 13, 2022.

Official description

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Affected products (as reported)

Vendor	Product	Versions
Facebook	WhatsApp Desktop	0.3.9309unspecified – before 0.3.9309

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

https://www.facebook.com/security/advisories/cve-2019-18426 x_refsource_CONFIRM
http://packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scripting.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18426 government-resource