WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS Devices
Summary: WhatsApp patched CVE-2025-55177 (CVSS 5.4), an insufficient authorization flaw in linked device synchronization messages that could let an unrelated user trigger processing of content from an arbitrary URL on a target's device, affecting its iOS and macOS apps. WhatsApp assessed the bug may have been chained with Apple's CVE-2025-43300, an out-of-bounds write in the ImageIO framework, in targeted zero-click attacks, and sent in-app threat notifications to fewer than 200 users.
What's compelling: Amnesty International's Donncha Ó Cearbhaill described the chain as zero-click and said early indications show it hitting both iPhone and Android users, civil society individuals among them, with WhatsApp recommending a full device factory reset to those it notified - and no one yet knows which spyware vendor is behind it.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-43300CVE-2025-55177
- Related