![\"WhatsApp](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2026\/01\/1769467934_342_0x0.jpg\")
<\/p>\n<\/p>\n
WhatsApp attack warning<\/p>\n
AFP via Getty Images<\/p>\n
An interesting start to the week for WhatsApp. Just hours after Telegram\u2019s Pavel Durov warned<\/a> that Meta\u2019s messenger has \u201cmultiple attack vectors,\u201d comes a report that Google has found a serious WhatsApp vulnerability that \u201copens up (an) attack surface.\u201d<\/p>\n Any warning from Google\u2019s Project Zero threat hunters is taken seriously. This is the team behind many of the zero-day spyware discoveries plaguing Android and iPhone. This threat affects WhatsApp on Android, and relates to zero-click media downloads. <\/p>\n ForbesGoogle Changes Gmail After 20 Years\u2014Do Not Lose Your Account NowBy Zak Doffman<\/a><\/p>\n The attack works when a victim and one of the victim\u2019s contacts are added to a new WhatsApp group. The attacker then makes the victim\u2019s contact an admin of the group, and then sends a malicious media attachment to that group. This will likely be automatically download to the victim\u2019s phone, which then opens the attack surface.<\/p>\n Google says Meta is currently working on a fix. They “pushed a server change on November 11 that partially resolved the issue, but are working on a comprehensive fix.” Meanwhile, Google tells users to \u201cdisable Automatic Download or enable WhatsApp Advance Privacy Mode, (t0) prevent the file from being automatically downloaded.\u201d<\/p>\n Attack vulnerability <\/p>\n Google Project Zero<\/p>\n I have warned before<\/a> that automatically downloading media from any message platform is dangerous. The messaging app is a sandbox, and should contain the threat. But once a file is added to a general media store that all changes.<\/p>\n This would likely be a targeted attack, Google says, because an attacker must know or guess a contact “making it lower severity than a full contact gating bypass.” But the Project Zero team warns \u201cit\u2019s easy to attempt this many times in quick succession, and likely easy to guess contacts in targeted attacks.\u201d <\/p>\n Neowin<\/a> spotted the Project Zero report, and explains it was reported privately to Meta on September 1, 2025, \u201cgiving the firm the standard 90 days to fix the issue before it was made public. Following Meta\u2019s failure to issue a fix by November 30, 2025, the vulnerability was made public.\u201d <\/p>\n Confirmation Meta is working on a fix came on December 4, \u201cThe ticket has not been updated with new communications since then,\u201d Neowin says, \u201cwhich would indicate that this bug is still open.\u201d I have reached out to Meta for any response. <\/p>\n ForbesGoogle\u2019s Chrome Decision\u2014Updates Stop For Millions Of Apple UsersBy Zak Doffman<\/a><\/p>\n It\u2019s worth making those changes anyway, regardless of any fix. You should not let media files download to your phone automatically. Only do so if you are sure of the sender and the origination of the file. Otherwise leave it where it is.<\/p>\n Meanwhile, Durov issued that unrelated warning on X: \u201cYou\u2019d have to be braindead to believe WhatsApp is secure in 2026. When we analyzed how WhatsApp implemented its \u2018encryption,\u2019 we found multiple attack vectors.\u201d There is nothing to substantiate this claim, and so for now it can be filed alongside Telegram\u2019s other strikes<\/a> at WhatsApp.<\/p>\n","protected":false},"excerpt":{"rendered":"WhatsApp attack warning AFP via Getty Images An interesting start to the week for WhatsApp. Just hours after…\n","protected":false},"author":2,"featured_media":259094,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[322,101189,85,68689,90256,46,125,136781,136779,136780],"class_list":["post-259093","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-android-attack","tag-android-hacker","tag-il","tag-iphone-attack","tag-iphone-hacker","tag-israel","tag-technology","tag-whatsapp-account-hacker-phone","tag-whatsapp-hack","tag-whatsapp-warning"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/259093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=259093"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/259093\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/259094"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=259093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=259093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=259093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}