CVE-2026-23866

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - cve-assign@fb.com

Published

2026-05-01

Last modified

2026-10-26

Weaknesses

CWE-940

Affected products

• Whatsapp For Android (Facebook)
• Whatsapp For Ios (Facebook)
• Whatsapp (Whatsapp)

References

• https://www.facebook.com/security/advisories/cve-2026-23866
• https://www.whatsapp.com/security/advisories/2026