A critical vulnerability has been identified in WhatsApp for Android devices, allowing cybercriminals to automatically download malicious files to victims’ devices through group conversations. The discovery, carried out by the Google Project Zero security team, exposes a flaw in the way the application manages administrator permissions and media downloads, creating a gateway for attacks that do not require any user interaction.
The issue was formally reported to Meta, WhatsApp’s parent company, on September 1, 2025. Conforme Conforme’s responsible disclosure policy, the flaw was made public after the end of the 90-day period, the period established for the company to develop and implement a complete fix. Embora a partial solution has been applied, the loophole still poses a risk to millions of platform users on the Android system.
The security flaw exclusively affects version Android of the messaging app, as other platforms, such as iOS and Windows, have different mechanisms for managing and downloading media files. Exploitation of the vulnerability depends on prior knowledge of the victim’s phone numbers and one of their contacts, which limits the scale of mass attacks, but does not negate the danger in targeted attacks.
To protect themselves, users can take immediate preventive measures, such as enabling advanced privacy settings in groups, disabling automatic downloading of all types of media, and keeping the app always up to date. Essas simple actions significantly increase the protection barrier against the exploitation of this and other vulnerabilities that may arise.
Technical details of the vulnerability
The exploitation of the flaw occurs in an ingenious way. The attacker creates a new group on WhatsApp and adds the target victim along with a known contact of the victim. The criminal then promotes this contact to group administrator, a crucial step for the success of the attack.
By turning a victim’s trusted contact into an administrator, the WhatsApp system bypasses standard protections that prevent the automatic download of media sent by unknown numbers. Isso opens a window for the attacker to send a malicious file, which will be automatically downloaded to the victim’s device and stored in Android’s MediaStore database.
The exploitation mechanism in groups
The security bypass is possible due to the differentiated treatment that WhatsApp grants to messages sent by group administrators. Once a victim’s contact becomes an administrator, even without their knowledge, the application starts to consider the media sent in that group as safe, authorizing automatic downloading.
For the attack to be successful, the malicious file needs to be sophisticated enough to “escape” the restricted MediaStore environment, known as the sandbox. If it achieves this feat, the malicious code can execute harmful commands on the operating system, such as stealing data, installing spyware, or other harmful actions, all without the user having to click on any links or open the file.
The specificity of the Android flaw is linked to the MediaStore architecture and the way the operating system interacts with third-party applications. Versions of WhatsApp for other platforms are not affected because they have fundamentally different programming and file management logic.
Protection measures for users
The first and most effective protective measure is to completely disable automatic media downloading. Para To do this, the user must access “Settings” in WhatsApp, select the “Storage and data” option and, in the “Automatic media download” section, deselect all options (photos, audios, videos and documents) for mobile networks and Wi-Fi.
Another important layer of security is control over who can add your number to groups. Nas “Privacy” settings, the user can define that only “My Contacts” can add them, avoiding inclusion in unknown groups created by attackers.
Within the groups you already participate in, it is recommended to activate “advanced privacy”, a feature that reinforces security against suspicious actions. The Essa option is usually available in each group’s detailed information and helps block exploit attempts like the one discovered.
Finally, keeping the WhatsApp application and the Android operating system always updated is essential. Updates often contain security patches that fix known vulnerabilities, protecting your device against the latest threats.
Response from Meta and corrections applied
After receiving the detailed report from Google Project Zero in September 2025, Meta began the process of analyzing and developing a fix. The 90-day deadline, which ended on November 30 of the same year, expired without a definitive solution being implemented, leading to the flaw being publicly disclosed, a standard industry practice to alert users and push for a faster resolution.
On December 4, 2025, Meta implemented a partial server-side fix, which mitigated some of the risk by making it more difficult to exploit the vulnerability on a large scale. However, the official Project Zero log indicates that the full solution was still in development, suggesting that certain attack scenarios could remain possible until a definitive patch is released to the application itself.
The role of Google Project Zero in cybersecurity
Google Project Zero is an elite team of security researchers dedicated to finding “zero-day” vulnerabilities – serious flaws still unknown to developers and the public – in software widely used by millions of people around the world, including operating systems and popular applications. The group’s mission is to make the internet a safer place by proactively identifying and reporting these breaches. The 90-day disclosure policy is one of its pillars, created to strike a balance between giving developers enough time to fix issues and ensuring that the public is informed about the risks if fixes are not applied on time. Project Zero’s work has already resulted in significant improvements in the security of countless technology products, forcing the industry to adopt higher standards of protection and respond more quickly to emerging threats.
Practical limitations of the attack
Despite the severity of the vulnerability, its practical exploitation has barriers that make massive attacks difficult. The main limitation is the attacker’s need to have not only the victim’s phone number, but also that of one of their contacts. Although data leaks have made this information more accessible, the correlation between two specific numbers still requires a targeted effort, making the attack more likely in individual espionage or stalking scenarios than in large-scale malware campaigns.
