Read the docs
TI-2019-13416 Aliases CVE-2019-18426GHSA-x67c-8vp2-26mr

Cross-site scripting in Meta WhatsApp Desktop

Priority CRITICAL 93Exploited in the wildCWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Why it matters now

Exploitation Active In CISA KEV since 2022-05-23CISA due date 2022-06-13
EPSS 0.67859 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WhatsApp Desktop (Facebook): 0.3.9309

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaWhatsApp Desktop0.3.9309; before 0.3.93090.3.9309Patch availableCNA
  • WhatsApp Desktop VendorMeta Affected 0.3.9309; before 0.3.9309 Fixed in 0.3.9309 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:desktop:*:*:*before 0.3.9309VulnerableWhatsApp
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*before 2.20.10VulnerableWhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:desktop:*:*:* Versions before 0.3.9309 Vulnerable ·WhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:* Versions before 2.20.10 Vulnerable ·WhatsApp

Remediation

  • Fix · CNA WhatsApp Desktop (Facebook) Fixed in 0.3.9309

Timeline

  1. 2022-05-23 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2019-18426
  3. 2026-10-03 Alias added: GHSA-x67c-8vp2-26mr

References

Exploit 1

Advisory 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2023-05201 Improper authorization in Meta React Developer Tools Extension CVSS 3.1MEDIUM 6.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences