CVE-2026-23866

Executive Summary

CVE-2026-23866 is a medium-severity vulnerability in WhatsApp for iOS and Android, affecting versions v2.25.8.0 through v2.26.15.72 (iOS) and v2.25.8.0 through v2.26.7.10 (Android). The flaw resides in the incomplete validation of AI-generated rich response messages for Instagram Reels. An attacker can craft a malicious message that, when processed by the recipient’s WhatsApp client, triggers the loading of media content from an arbitrary URL. This can include URLs that invoke OS-controlled custom URL scheme handlers (e.g., tel:, mailto:, or third-party app schemes), potentially leading to unintended actions such as initiating phone calls, sending emails, or launching other applications without user consent.

The vulnerability does not require authentication but does require user interaction (the recipient must view the malicious message). The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating no active exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects the WhatsApp mobile application distributed through official app stores (Apple App Store, Google Play Store). Users should ensure they are running the latest version of WhatsApp to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – the attacker can send the malicious message remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): Required – the victim must view the message.
• Scope (S): Unchanged – the vulnerability does not affect other components.
• Confidentiality (C): None – no data exposure.
• Integrity (I): Low – the attacker can trigger actions on the victim’s device.
• Availability (A): None – no denial of service.

Threat Level: Medium. While exploitation is not currently observed, the ability to trigger arbitrary URL schemes could be leveraged for phishing, social engineering, or launching other applications with malicious intent.

Deep Dive & Mechanics

The vulnerability exists in the processing of AI-generated rich response messages for Instagram Reels. WhatsApp uses AI to generate previews or responses for shared Reels content. The validation logic for URLs embedded in these responses is incomplete, allowing an attacker to inject arbitrary URLs.

Technical Flow:

1. An attacker sends a message containing a crafted AI rich response for an Instagram Reel.
2. The recipient’s WhatsApp client processes the message and attempts to fetch media content from the URL specified in the response.
3. Due to insufficient validation, the client does not restrict the URL scheme or domain.
4. The client then triggers the OS to handle the URL, which may invoke custom URL scheme handlers (e.g., tel://1234567890 to initiate a call, or myapp://someaction to launch a third-party app).

Root Cause: The AI response generation module does not sanitize or restrict the URL field, allowing arbitrary input to be passed to the system’s URL handling mechanism.

Vulnerable vs. Patched Code

Since no official patch has been released, a comparison is based on expected remediation.

Vulnerable Code (Conceptual):

// Vulnerable: No validation of URL scheme or domain
function processAIResponse(response) {
    let mediaUrl = response.mediaUrl;
    // Directly fetch and process the URL
    fetch(mediaUrl).then(...);
}

Patched Code (Expected):

// Patched: Validate URL scheme and domain
function processAIResponse(response) {
    let mediaUrl = response.mediaUrl;
    // Allow only https and specific domains
    if (mediaUrl.startsWith('https://') && mediaUrl.includes('instagram.com')) {
        fetch(mediaUrl).then(...);
    } else {
        // Reject or sanitize
        console.error('Invalid URL');
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WhatsApp account on a vulnerable version (iOS v2.25.8.0 to v2.26.15.72 or Android v2.25.8.0 to v2.26.7.10).
• Ability to send messages to a target user.

Exploitation Steps:

1. Craft a malicious AI rich response message with a URL pointing to a custom scheme, e.g., tel://+1234567890.
2. Send the message to the target.
3. When the target views the message, WhatsApp will attempt to process the URL, triggering the OS to initiate a phone call.

Proof-of-Concept (No public exploit available):

# Conceptual Python script to generate malicious message
import requests

def send_malicious_message(target_phone, attacker_token):
    url = "https://graph.facebook.com/v18.0/me/messages"
    headers = {"Authorization": f"Bearer {attacker_token}"}
    payload = {
        "recipient": {"phone_number": target_phone},
        "message": {
            "text": "Check out this Reel!",
            "ai_rich_response": {
                "mediaUrl": "tel://+1234567890"
            }
        }
    }
    response = requests.post(url, json=payload, headers=headers)
    return response.json()

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for unusual URL schemes in WhatsApp messages (e.g., tel:, mailto:, sms:).
• Implement network-level filtering to block outbound requests to non-standard URL schemes.
• Educate users to avoid clicking on suspicious links or messages from unknown senders.

Honeypot Setup:

• Deploy a WhatsApp honeypot on a vulnerable version to capture malicious messages.
• Analyze incoming messages for abnormal URL patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound requests to URLs with non-standard schemes (e.g., tel:, mailto:, sms:).
  • Connections to domains not typically associated with Instagram or WhatsApp CDNs.

• Host IOCs:

  • WhatsApp client logs showing processing of URLs with unusual schemes.
  • Unexpected application launches (e.g., phone dialer, email client) triggered by WhatsApp.

• File IOCs:

  • Malicious messages stored in WhatsApp database with mediaUrl fields containing arbitrary schemes.

Detection Engineering

YARA Rule

rule CVE_2026_23866_WhatsApp_AI_URL_Injection {
    meta:
        description = "Detects malicious AI rich response messages with arbitrary URL schemes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-23866"
    strings:
        $url_scheme = /(tel|mailto|sms|facetime|skype|whatsapp):\/\// nocase
        $ai_response = "ai_rich_response"
    condition:
        $ai_response and $url_scheme
}

Sigma Rule

title: CVE-2026-23866 - WhatsApp AI Rich Response URL Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects WhatsApp messages containing AI rich responses with non-standard URL schemes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-23866
logsource:
    product: whatsapp
    service: message_logs
detection:
    selection:
        message_type: "ai_rich_response"
        mediaUrl|contains:
            - "tel://"
            - "mailto://"
            - "sms://"
            - "facetime://"
            - "skype://"
            - "whatsapp://"
    condition: selection
falsepositives:
    - Legitimate use of custom URL schemes by trusted contacts
level: medium
tags:
    - attack.t1204
    - cve.2026.23866

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-23866 - WhatsApp AI Rich Response URL Injection"; flow:to_server,established; content:"ai_rich_response"; http_client_body; pcre:"/(tel|mailto|sms|facetime|skype|whatsapp):\/\//i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update WhatsApp: Users should update to the latest version available on the Apple App Store or Google Play Store. While no specific patch is mentioned, newer versions may include additional validation.
2. Disable AI Features: Temporarily disable AI-powered features in WhatsApp settings if available.
3. User Awareness: Educate users not to open suspicious messages or click on links from unknown senders.

Long-Term Fixes:

• Input Validation: Implement strict validation of URL schemes and domains in AI response processing.
• Allowlist Approach: Only allow URLs from trusted domains (e.g., instagram.com, cdninstagram.com).
• OS-Level Controls: Use iOS/Android APIs to restrict URL scheme handling to safe schemes.

Detection & Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Monitor for unusual outbound connections from WhatsApp processes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 7120B6549DC123738AC8A7F3] */}