CVEvulnerability

CVE-2019-18426

8.2 HIGH Known exploited Published 2020-01-21 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

WhatsApp Cross-Site Scripting Vulnerability — Meta Platforms WhatsApp

A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

Added to KEV
2022-05-23
Remediation due
2022-06-13
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2019-18426
Status
Analyzed
Published
2020-01-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-79

Description

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Affected configurations

• whatsapp whatsapp (< 0.3.9309) • whatsapp whatsapp (< 2.20.10)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References