ZeroDay Findings
Sign inSign up

Findings

CVE-2019-18426

WhatsApp Cross-Site Scripting Vulnerability

Published Jan 21, 2020 · updated Jun 16, 2026 · whatsapp whatsapp

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 21, 2020 · Catalog

    Detected

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

  2. May 23, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 13, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Required action

Apply updates per vendor instructions.

CISA due date Jun 13, 2022

Affected

  • cpe whatsapp/whatsappversion unspecified
  • vendor Meta Platforms WhatsAppversion unspecified

Sources

  • CISA KEVCVE-2019-18426

    A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

    cisa.gov
  • CVE.orgCVE-2019-18426

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-18426

    30-day exploitation probability 67.9%

    first.org
  • Exploit Database48295

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2019-18426

    A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scripting.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2019-18426 · ZeroDay Findings