A cybersecurity expert has unearthed a vulnerability in WhatsApp Web for desktop computers that exposes the private files of users.
The flaw was found by JavaScript expert Gal Weizman, and affects users with an iPhone paired to WhatsApp Web.
Mr Weizman exploited a weakness in WhatsApp’s Content Security Policy, which allowed normal security measures to be bypassed.
The Facebook-owned app prides itself on security and has end-to-end encryption in place to protect messages.
But this vulnerability, that was reported to WhatsApp and fixed in December, could have given hackers access to private files, photos and videos stored on a computer.
WhatsApp claims there are no known cases of a criminal exploiting this vulnerability to hack a customer.
Scroll down for video
It was found by JavaScript expert Gal Weizman and was discovered to affect users with an iPhone paired to WhatsApp Desktop. Hackers could change the URL that pops up in the banner message (pictured) when a link is sent to mislead users
Mr Weizman showed that the flaw also allowed messages to be tampered with by hackers, who could make a link look legitimate and disguise its nefarious purpose.
Unsuspecting users would receive dangerous messages which gave hackers access to the desktop’s files.
In a blog post for PermineterX, Mr Weizman said: ‘Long story short, unsuspecting users could be subject to harmful code or links injected into their seemingly innocuous exchanges.
‘These message modifications would be completely invisible to the untrained eye.’
The December update for WhatsApp featured a patch for this vulnerability and users are urged to update their app immediately to ensure they are protected.
But cybersecurity expert Corin Imai at DomainTools said the vulnerability is definitely ‘a cause for concern’.
Ms Imai said: ‘WhatsApp has an estimated 1.5 billion monthly users, and in developing democracies such as India where WhatsApp counts 200million user base, it has become a substitute of town-square talk.
WHAT WAS THE VULNERABILITY?
