Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp
Summary: Project Zero's Natalie Silvanovich spent extensive effort reviewing WhatsApp call signalling in 2018 looking for a remote, interaction-less vulnerability, and found none. She built a modified APK that intercepted and altered peer-to-peer and peer-to-server encrypted signalling messages, but the code was conservatively written and the server stripped or rejected the voip_options parameter she hoped to exploit.
Key Takeaway: The voip_options field is never sent by the sending device but is added by the WhatsApp server and contains dozens of configuration parameters feeding a JSON parser - attack surface a peer cannot reach only because the server strips it before forwarding.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026