High severity8.2CISA KEVNVD Advisory· Published Jan 21, 2020· Updated Jun 17, 2026

CVE-2019-18426

Description

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Whatsapp/Whatsapp2 versions
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*+ 1 more
- cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*range: <2.20.10
- cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:desktop:*:*:*range: <0.3.9309
Whatsapp/Whatsapp Desktopllm-fuzzy
Range: <0.3.9309
Whatsapp/WhatsApp for iPhonellm-fuzzy
Range: <2.20.10
Facebook/WhatsAppllm-fuzzy
Range: <0.3.9309, <2.20.10
Facebook/WhatsApp Desktopcpe-rescue
Range: 0.3.9309

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scripting.htmlnvdExploitThird Party AdvisoryVDB Entry
www.facebook.com/security/advisories/cve-2019-18426nvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.054
exploit	0.030
kev	0.120
patch	0.000
ransomware	0.000