Log in Start free

Vulnerability · Published May 1, 2026 · Assigned by Meta

CVE-2026-23866

Medium 4.3

In plain English

A medium-severity security flaw in WhatsApp for Android from Facebook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Affected products (as reported)

VendorProductVersions
Facebook WhatsApp for Android 2.25.8.0 – before 2.26.7.10
Facebook WhatsApp for iOS 2.25.8.0 – before 2.26.15.72

Weakness: CWE-940 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C

References