Live › vulnerability › CVE-2019-18426
Go to dashboardA cross-site scripting flaw in WhatsApp Desktop, when paired with WhatsApp for iPhone, lets injected script run in the app. An attacker can use it to read local files on the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Meta Platforms WhatsApp | vendor | – | – |
Unknown from the sources.
Apply updates per vendor instructions (CISA KEV entry); the sources do not name a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
This page as .md · .json · in your agent: get_signal("CVE-2019-18426")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.