WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities

2026-05-06

WhatsApp fixed two medium-severity bugs reported via Meta's bug bounty. One let attackers spoof Windows attachments using NUL bytes, so an apparent document executed instead. The other mishandled AI-rich responses for Instagram Reels in iOS and Android, allowing arbitrary URLs and OS URL schemes to be processed on a victim device. Meta reports no in-the-wild exploitation.