CVE-2019-18426

WhatsApp Cross-Site Scripting Vulnerability

Exploited in attacks High 8.2 Attack chance: 68%

What it is

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

CISA: A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 13, 2022

Added to the CISA list: May 23, 2022
Published: January 21, 2020
Severity: High 8.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 68% in the top 0.7% of all known vulnerabilities
Weakness: CWE-79
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Meta Platforms

Added	Vulnerability	Product	Severity	Attack chance
Sep 2, 2025	Incorrect AuthorizationCVE-2025-55177	WhatsApp	Medium 5.4	13%
Apr 19, 2022	VOIP Stack Buffer OverflowCVE-2019-3568	WhatsApp	Critical 9.8	30%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.