CVE-2026-23866

弱点类型

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

受影响产品

• whatsapp whatsapp

参考链接

• https://www.facebook.com/security/advisories/cve-2026-23866
• https://www.whatsapp.com/security/advisories/2026