3. Content material supplier traversal: The quiet knowledge leak
This vulnerability permits an attacker app put in on the identical machine to question WhatsApp’s uncovered content material suppliers and traverse file paths outdoors of supposed directories. If file path validation is lacking, attackers can entry recordsdata comparable to cached media, logs, or momentary session knowledge.
📍Instance exploit: A malicious photograph enhancing app silently queries WhatsApp’s storage, pulling unencrypted media or momentary chat backups through a poorly secured content material supplier.
4. Weak cryptography: Predictable keys, actual dangers
We flagged derived encryption keys that lacked adequate randomness or entropy. In a safe cellular app, encryption keys must be both user-specific, generated per session, or hardware-backed.
🔓 Influence: Predictable key derivation implies that even encrypted knowledge — comparable to momentary recordsdata or offline media — might be brute-forced or decrypted utilizing identified patterns.
5. TLS enforcement gaps: A step again in 2025
TLS is desk stakes. However we nonetheless noticed fallback logic and lacking checks in certificates validation.
In sure circumstances, connections to backend providers might probably be redirected or spoofed by a malicious actor.
🕵️♂️ MITM state of affairs: A compromised root certificates on the machine allows an attacker to proxy TLS site visitors, probably leaking analytics or system-level knowledge that isn’t protected by end-to-end encryption.
📌 Wish to find out how flaws like these will be prevented early within the improvement lifecycle?
Try our Safe SDLC weblog to study why choosing a safe SDLC method is the best way ahead for figuring out vulnerabilities early.
What WhatsApp obtained proper
We’re not right here to simply throw stones. WhatsApp additionally exhibits indicators of mature safety apply:
- Finish-to-end encryption is powerful and properly applied for messages and calls.
- Permissions are minimal and justified, with no pointless overreach into machine entry.
- Tamper resistance is efficient in stopping unauthorized app modifications or rooted setting abuse.
In some ways, WhatsApp’s safety baseline is increased than most apps in its class. However perfection is elusive — and that’s the place attackers thrive.
Why these flaws matter
You would possibly assume {that a} Meta-backed app with billions of customers would have hermetic safety. However the actuality is:
- Safety is just not a one-time effort. Frequent app updates can inadvertently introduce new dangers.
- Attackers goal metadata, backups, and infrastructure, not simply the messages.
- Even “non-critical” flaws turn out to be essential when chained collectively.
The belief hole is actual.
In our newest US client survey, 63% of customers reported they assume WhatsApp is safe. And but, each essential and high-severity flaw we examined on this newest model was actual, not hypothetical.
That is the belief hole: customers imagine in manufacturers, attackers imagine in bugs.
🛡️Safety isn’t nearly encryption. It’s about self-discipline, testing, and transparency. Particularly if you’re powering international communication.
At Appknox, we take a look at the apps individuals belief most in order that belief is earned, not assumed.
Wish to take a look at your app’s real-world safety posture?
Guide a demo with us or converse to our safety engineers at present.
Key advantages of Appknox
- Seamless CI/CD integration with automated scans on each construct
- Uncover hidden and shadow APIs to get rid of blind spots
- Complete protection of OWASP API Prime 10 and misconfigurations
- Developer-friendly, actionable remediation studies
- Minimal false positives to maintain groups centered.
Appknox doesn’t simply automate testing—it transforms safety from a bottleneck right into a progress enabler.
Detect vulnerabilities in minutes with deep, automated scans.
Begin your free trial with Appknox at present and escape safety blind spots in your utility portfolio.
TL;DR: WhatsApp could also be safe, however not invulnerable
- In June 2025, WhatsApp confronted renewed scrutiny over safety considerations.
- Reviews revealed that Israel stays the one identified nation-state to have efficiently exploited the app. Nonetheless, historical past suggests this might open the door for extra actors to comply with.
- Appknox performed a real-world safety audit of WhatsApp’s Android app (v2.25.9.78).
- Our pentesters carried out each Static and Dynamic Software Safety Testing (SAST + DAST) on actual units.
- Regardless of WhatsApp’s sturdy safety basis, the audit uncovered:
- 1 essential vulnerability
- A number of high-severity flaws
- These points might allow:
- Site visitors interception
- Unauthorized entry to person knowledge
- Weakened or bypassed encryption mechanisms
Steadily requested questions (FAQs)
1. Is WhatsApp safe in 2025?
Whereas WhatsApp makes use of sturdy end-to-end encryption, our penetration testers recognized a number of vulnerabilities, together with MITM dangers and hardcoded secrets and techniques inside the APK.
2. Can WhatsApp be hacked by public Wi-Fi?
Sure. In our evaluation, we recognized weak community configurations that will permit attackers to intercept metadata over unsecured networks.
3. Does WhatsApp leak person knowledge?
Our pentest revealed that sure vulnerabilities, comparable to file traversal and hardcoded keys, might be exploited to extract person knowledge underneath particular situations.
4. How does Appknox take a look at apps like WhatsApp?
We use real-device Dynamic and Static Software Safety Testing (DAST/SAST) to simulate real-world exploitation methods.