WhatsApp Zero-Day Vulnerability Exploited with 0-Click Attacks to Hack Apple Devices

WhatsApp has issued a critical security advisory about a newly discovered zero-day vulnerability, tracked as CVE-2025-55177, which has been exploited in highly sophisticated zero-click attacks targeting Mac and iOS users. The vulnerability, combined with an OS-level flaw (CVE-2025-43300) in Apple’s ImageIO framework, raises concerns about memory corruption and unauthorised access to device data.

The flaw stems from an incomplete authorisation of linked device synchronization messages in WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac, enabling an unrelated user to render content from an arbitrary URL on a target’s device. According to WhatsApp’s security advisory, the two flaws together create a potent attack vector, and Amnesty International’s Security Lab is conducting an active investigation into cases involving targeted individuals.

Early indications suggest the WhatsApp attack is impacting both iPhone and Android users, affecting civil society figures such as journalists and human rights defenders. Mitigations include updating WhatsApp to the latest versions (iOS v2.25.21.73 or later, Business iOS v2.25.21.78 or later, Mac v2.25.21.78 or later), installing the latest OS updates, and enabling features like Lockdown Mode on iOS or Advanced Protection on Android.