Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-863
Descriptions
KEV: Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
warncomponent_extraction: Component 'WhatsApp for iOS, WhatsApp Business for iOS, WhatsApp for Mac' matches or contains product name 'WhatsApp' — no specific component identified
Hunting hypothesis agent
Monitor for unusual linked device synchronization requests containing arbitrary URLs targeting WhatsApp for iOS or Mac application devices.
Research details
ComponentWhatsApp for iOS, WhatsApp Business for iOS, WhatsApp for Mac
PreconditionsTarget device must run WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS prior to v2.25.21.78, or WhatsApp for Mac prior to v2.25.21.78; Attacker must be able to send crafted linked device synchronization messages agent
Exploit notesExploited in combination with Apple OS-level vulnerability CVE-2025-43300 as a zero-click chain; requires no user interaction. CVSS v3 base score not published by NVD.
SummaryCVE-2025-55177 is an incomplete authorization vulnerability in WhatsApp's linked device synchronization feature affecting iOS and macOS. The flaw (CWE-863) allows an unrelated attacker to trigger processing of content from an arbitrary URL on a target's device by sending crafted synchronization messages without proper authorization checks. Meta's internal security team discovered the vulnerability, which was exploited in sophisticated targeted attacks against specific users in combination with CVE-2025-43300 (Apple ImageIO out-of-bounds write). Patches were released in WhatsApp for iOS v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78. CISA added to KEV catalog on 2025-09-02 with a required action date of 2025-09-23.
Tia coverage
First reported2026-05-27
First exploit report2026-05-27
Exploit report → KEV267 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.