The app does not store user messages or voice recordings on any servers, and automatically encrypts all communications in such a way that even WhatsApp staff does not have access to it. User safety has long been one of the central marketing points of WhatsApp. The mobile app does not appear to be affected by the WhatsApp security flaw, unless iOS users paired it with desktop app versions prior to 2.20.10 (which was released in mid-January 2020). This incident also makes clear that anything else running on an outdated version of Chromium needs to be updated immediately to curtail similar security vulnerabilities.

If the user has antivirus software or a browser (such as a recent version of Google Chrome) that verifies JavaScript URLs before loading or simply blocks them outright, they may be protected even if they open a malicious message.Īt the organizational level, PerimeterX suggests setting a policy of verifying all URLs before they load on the receiving side and configuring content security policy (CSP) rules to thwart cross-site scripting attacks. The best solution at the individual level is simply updating to the latest desktop version of WhatsApp. It is unclear if any bad actors managed to come upon this avenue of attack before Weizman disclosed it, but the world is aware of it and capable of using it on outdated clients now. The breach window on this flaw potentially dates back to the launch of the WhatsApp desktop client in 2016, and it is still active in older versions of the software that have not been updated. Protection and recovery from the WhatsApp security flaw A similar flaw in Chromium was discovered by security researchers and patched out some time ago, but WhatsApp uses a variant framework called Electron that is apparently still running on old Chromium code.

The bug at the root of the WhatsApp security flaw traces back to Google’s Chromium framework, which underpins WhatsApp.

Is whatsapp safe