Users of WhatsApp are advised to review their settings and ensure they have the latest version of the app installed due to the discovery of two significant software vulnerabilities. Security analysts have identified issues related to how media files and attachments are managed, as well as a specific concern for users of WhatsApp on Windows.
Malwarebytes experts have cautioned that while these vulnerabilities do not automatically lead to device infections, they could facilitate social engineering attacks by cybercriminals or be combined with other vulnerabilities to pose more severe threats.
A potential risk highlighted by Malwarebytes is that a malicious message could deceive a device into opening content from an untrusted source.
The vulnerabilities, labeled as CVE-2026-23866 and CVE-2026-23863, were uncovered through Meta’s Bug Bounty program.
Currently, there is no evidence indicating that these flaws have been exploited in real-world scenarios or used to compromise smartphones. WhatsApp has stated that they have not observed any instances of exploitation in practice.
Nevertheless, the company under Meta ownership has released an update and strongly recommended that users review their settings. To ensure security, users are urged to verify that WhatsApp is completely up to date on their devices.
For Android users, updating WhatsApp can be done by accessing the Google Play Store, searching for WhatsApp Messenger, and selecting “Update.” iPhone users are advised to open the App Store, locate WhatsApp in the profile section, and choose “Update.”
Following the update installation, phones will be safeguarded against potential future attacks.
This cautionary notice coincides with the impending loss of WhatsApp access for some older Android devices. WABetaInfo reports that WhatsApp intends to discontinue support for devices running versions older than Android 6 starting from September 8, 2026. Affected users may receive a message indicating that WhatsApp will cease to function on their devices later in the year.
However, the impact is expected to be minimal as Android 6 was introduced in 2015 and is now rarely found on modern smartphones.
