Vulnerability intelligence

CVE-2026-23866

Facebook WhatsApp for Android

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

CVSS Score

4.3

Medium

EPSS — Exploit Probability

0.5%

Riskier than 39% of all CVEs · checked 2026-09-08

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories