WhatsApp 0-Click Exploit Disclosed to Meta at Pwn2Own Security Event

Cybersecurity researchers from Team Z3 withdrew their planned demonstration of a zero-click remote code execution vulnerability in WhatsApp at the Pwn2Own Ireland 2025 hacking competition, choosing private coordinated disclosure to Meta instead. The exploit was billed as a potential record-breaking $1 million bounty and was one of the crowd’s top anticipated demonstrations at the three-day event in Cork, Ireland, held from 21 to 23 October 2025.

According to the Zero Day Initiative, the event organisers, Team Z3 felt their research was not ready for a live public display, and the move emphasised a structured path to disclosure with Meta engineers. Meta, WhatsApp’s parent company and a co-sponsor of Pwn2Own Ireland, reaffirmed its commitment to strengthening the app’s defenses following the private disclosure channel that allows up to 90 days post-event for patching before public revelation.

The conference nonetheless awarded $1,024,750 in prizes for 73 unique zero-day vulnerabilities discovered across devices, with successful exploits targeting the Samsung Galaxy S25, Philips Hue Bridge, Lexmark and Canon printers, QNAP NAS, and Ubiquiti cameras.