WhatsApp Warns Users About Security Flaws: File Spoofing and Malicious URLs
Cybersecurity Firm Discovers File Spoofing and Arbitrary URL Scheme Vulnerabilities
A recently released security advisory from a prominent technology company details two newly patched vulnerabilities affecting their popular messaging application.
- The first vulnerability, identified as CVE-2026-23863, is a medium-severity issue impacting versions of the software prior to 2.3000.1032164386.258709. By exploiting this flaw, an attacker could create a maliciously formatted document containing NUL bytes in its filename. When received as an attachment, the recipient would view it as innocuous, but it would execute as a program upon opening.
- The second vulnerability, designated as CVE-2026-23866, has a medium-impact rating and affects both iOS and Android versions of the messaging app. Incomplete validation of AI-rich response messages for Instagram Reels could potentially enable an attacker to trigger processing of media content from an arbitrary URL on another user’s device. This could lead to redirection to phishing sites or initiation of other applications and services on the device via URL schemes like facetime:, tel:, itms-apps:, or custom app deep links.
According to the company, “t
About Author
English