CoreCVE
Back

MEDIUM

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers

Published May 1, 2026

Description

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-940

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Meta
Published May 1, 2026
Updated May 1, 2026
Reserved Jan 16, 2026
Link CVE-2026-23866

CISA Vulnrichment

Updated May 1, 2026

NVD

Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-23866

Red Hat

No data

ENISA EUVD

Assigner Meta
Published May 1, 2026
Updated May 1, 2026
Link EUVD-2026-26666

GitHub

No data