Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes

SecurityWeek reports that Meta has begun addressing WhatsApp vulnerabilities that expose user metadata, notably flaws that allow device fingerprinting of a user’s operating system. The article notes that attackers can use zero-days to deliver spyware through WhatsApp, with Paragon spyware attacks in 2025 targeting dozens of users via such flaws.

WhatsApp, which has 3 billion users, has seen Meta start randomising key IDs on Android to hinder fingerprinting, while researchers say the technique still works and remains a privacy issue. Tal Be’ery is highlighted as a leading investigator who developed a private WhatsApp fingerprinting tool and has reported findings to Meta, which has acknowledged steps to harden the app and improve communications around these issues.

The piece also mentions that Meta has paid out about $25 million through its bug bounty programme since its inception, including $4 million in 2025, and references ongoing action against spyware makers such as NSO. It is dated 5 January 2026.