WhatsApp patches vulnerability exploited in zero-day attacks

WhatsApp has patched a zero-click vulnerability in its iOS and macOS messaging clients that was exploited in targeted zero-day attacks, with the flaw tracked as CVE-2025-55177 and affecting WhatsApp for iOS prior to version 2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78.

In a Friday security advisory, WhatsApp said that incomplete authorisation of linked device synchronization messages could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device, and that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

Apple had released emergency updates earlier this month to patch CVE-2025-43300, stating that the flaw had been exploited in an extremely sophisticated attack. Amnesty International’s Donncha Ó Cearbhaill, quoted by security researchers, noted that WhatsApp warned some users they had been targeted in an advanced spyware campaign over the last 90 days, with guidance to perform a device factory reset and keep OS and software up to date.

The report also recalls that in March WhatsApp patched another zero-day flaw used to install Paragon’s Graphite spyware, indicating a pattern of high-skill campaigns targeting journalists and civil society.