Security researchers have identified two critical vulnerabilities in WhatsApp that could potentially expose users to cyber threats. The flaws affect the way media files and attachments are managed, as well as posing a risk to Windows users of the messaging platform.
Although these vulnerabilities do not automatically infect devices, they could be exploited by cybercriminals for social engineering attacks or combined with other security weaknesses for more severe consequences. Malicious messages could deceive devices into opening content from untrusted sources, leading to potential risks.
These vulnerabilities, known as CVE-2026-23866 and CVE-2026-23863, were uncovered through Meta’s Bug Bounty program. While there is no evidence of real-world exploitation or phone infections, WhatsApp has urged users to update their settings as a precautionary measure.
To safeguard against potential threats, users must ensure they have the latest version of WhatsApp installed on their devices. Android users can update through the Google Play Store by searching for WhatsApp Messenger and selecting “Update.” iPhone users should access the App Store, locate WhatsApp in their profile, and choose “Update” for enhanced protection.
In related news, older Android devices may soon lose access to WhatsApp, with support ending for devices running versions older than Android 6 starting September 8, 2026. Affected users may receive a notification indicating the app will no longer function on their devices. While this may not impact most users, as Android 6 is now outdated, it underscores the importance of staying updated on software compatibility for continued use of essential services.