Live › vulnerability › CVE-2025-55177
Go to dashboardWhatsApp fails to fully check authorization on synchronization messages sent to linked devices. An unrelated user can make a target's device process content fetched from an arbitrary URL.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Meta Platforms WhatsApp | vendor | – | – |
| vendor | >= 2.22.25.2, < 2.25.21.73 | 2.25.21.73 | |
| vendor | >= 2.22.25.2, < 2.25.21.78 | 2.25.21.78 | |
| whatsapp business | vendor | >= 2.22.25.2, < 2.25.21.78 | 2.25.21.78 |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
This page as .md · .json · in your agent: get_signal("CVE-2025-55177")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.