---
id: "CVE-2019-18426"
kind: "vulnerability"
aliases: ["CVE-2019-18426"]
title: "Meta Platforms WhatsApp: WhatsApp Cross-Site Scripting Vulnerability"
severity: "high"
cvss: 8.2
epss: 0.67859
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Meta Platforms WhatsApp", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ios", "macos", "vendor", "whatsapp-desktop", "windows"]
not_affected_if: ["not-paired-with-iphone"]
published_at: "2020-01-21T21:15:16+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-18426", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-18426", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18426", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Meta Platforms WhatsApp: WhatsApp Cross-Site Scripting Vulnerability

A cross-site scripting flaw in WhatsApp Desktop, when paired with WhatsApp for iPhone, lets injected script run in the app. An attacker can use it to read local files on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Meta Platforms WhatsApp affected ? fixed ?

## Fix

Apply updates per vendor instructions (CISA KEV entry); the sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-18426
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-18426
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-18426

## From the sources

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_