Silent Update Fixes Dangerous WhatsApp Vulnerability on Apple Devices
Silent Update Fixes Dangerous WhatsApp Vulnerability on Apple Devices
WhatsApp remains the world’s most widely used messaging platform, relied on daily by billions for both personal conversations and professional communication. But its massive user base also makes it a prime target for cyberattacks — and recently, a critical security flaw was discovered that allowed hackers to steal data from users without them even noticing.
Meta has confirmed it has patched a high-severity vulnerability, tracked as CVE-2025-5517, which stemmed from incomplete authorization in how the app handles “linked device synchronization messages.” This flaw, on its own, opened the door for unauthorized access — but when combined with another vulnerability, it became far more dangerous.
A Silent Hack: No Clicks, No Warning
What made this exploit particularly alarming was its zero-click nature. According to Meta’s security advisory, attackers could chain the WhatsApp flaw with another vulnerability, CVE-2025-43300, to force the app to process content from a malicious URL — all without any interaction from the user.
That means a victim didn’t need to tap a link, answer a call, or open a message. Simply receiving a specially crafted synchronization packet was enough to trigger the exploit, potentially giving attackers access to messages, media, and other sensitive data stored on the device.
The Apple Connection: A Deeper System Flaw
Further analysis by Donncha Ó Cearbhaill of Amnesty International’s Security Lab revealed that the second vulnerability was tied to Apple’s Core Image framework — a system-level component used across iOS and macOS for image processing. This means the flaw wasn’t limited to WhatsApp; any app processing maliciously crafted image data could have been exploited.
Apple has since released a fix for this underlying issue in recent OS updates. However, for devices that hadn’t been updated, the combination of the WhatsApp and iOS vulnerabilities created a powerful attack vector that was likely used in highly targeted operations.
Meta Warns Affected Users — and Recommends Factory Reset
Meta has reportedly begun notifying users who may have been targeted through this exploit. In a rare move, the company is advising potentially compromised users to perform a factory reset of their devices — even though the bug has already been patched.
Why? Because zero-click exploits can install persistent malware that survives software updates. A full reset is the safest way to ensure any hidden payload is removed.
While Meta hasn’t disclosed the exact number of affected users, evidence suggests the attacks have been ongoing for at least three months. The sophistication of the exploit chain suggests it was likely aimed at high-value targets, such as journalists, activists, or corporate executives — though regular users aren’t completely out of risk.
Which Devices Are Still at Risk?
The vulnerability affects older versions of WhatsApp on Apple devices. If you’re using any of the following, update immediately:
- WhatsApp for iOS before version 2.25.21.73
- WhatsApp Business for iOS before version 2.25.21.78
- WhatsApp for Mac before version 2.25.21.78
Updating ensures you have the latest security patches. You can check your version in Settings > Help > App Info (on mobile) or WhatsApp > About (on Mac).
What Should Users Do Now?
- Update WhatsApp — Make sure you’re on the latest version available on the App Store or Mac App Store.
- Update your OS — Install the latest iOS and macOS updates to patch the Core Image vulnerability.
- Restart the app — After updating, fully close and reopen WhatsApp to ensure changes take effect.
- Consider a factory reset — Only if you suspect targeting (e.g., you’re in a high-risk group).
- Enable two-step verification in WhatsApp for added account protection.
The Bigger Picture: Security in the Age of Silent Exploits
This incident is another reminder that modern cyber threats are becoming increasingly invisible. With zero-click attacks, there’s no warning sign — no suspicious link, no odd message. The only defense is staying up to date.
WhatsApp’s quick response and coordination with security researchers helped contain the threat before it spiraled. But as long as messaging apps remain central to our digital lives, they’ll continue to be hunted by those looking to break in — silently and undetected.
Stay safe. Stay updated.
