4.3 Medium
CVE-2026-23866
Facebook WhatsApp for Android vulnerability
FacebookWhatsApp for Android
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 23 Oct
0.5%probability of exploitation in the next 30 days
Higher than 39% of scored CVEs
SeverityCVSS
4.3Medium
Description NVD
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
Coverage 1 article · 1 outlet
- WhatsApp fixes attachment spoof and AI mediated URL bugSecurityWeek · first in our coverage · mentions it in passing