CVE-2019-18426
KEVHIGH 8.2EPSS 67.9%
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
- CVSS v3.1
- 8.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS v3.1
- 8.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS v2.0
- 5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N - EPSS
- 67.86% chance of exploitation in the next 30 days, 99th percentile
- CISA KEV
- added 2022-05-23
- Published
- 2020-01-21
- Updated
- 2025-10-21
Proof-of-concept exploits (3)
- http://packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scriptin…
- HumanSecurity/CVE-2019-1842611★ · 2020-03-05
- PerimeterX/CVE-2019-1842611★ · 2020-03-05